.png){kind=logo}
SignServer supports signing a wide range of file formats and artifact types through a set of purpose-built Signer Workers. This page provides a quick-reference overview of what can be signed, which Worker to use, and links to further documentation.
For an introduction to how Signer Workers are structured, see Signers.
Some Workers require a SignServer Enterprise license. Community edition users should refer to the non-Enterprise alternatives in the same format category where available.
Client-side hashing is supported by a subset of Workers, allowing the data to be hashed on the client before sending only the hash to SignServer. This can reduce network transfer for large files and avoids sending raw document content to the server. See Client-side Hashing for configuration details.
For algorithm support by Signer, see Supported Algorithms.
Document Signing
SignServer supports the following document signing formats:
|
Format / Artifact |
Worker |
Description |
Enterprise |
|---|---|---|---|
|
XML |
Creates enveloped XML signatures using XMLDSig. |
|
|
|
PDF (ISO 32000) |
Adds digital signatures to PDF documents, including support for:
|
|
|
|
PDF (AdES) |
PAdES (PDF Advanced Electronic Signatures) signatures conforming to ETSI advanced electronic signature formats. Supported levels: -B, -T, -LT, -LTA |
|
|
|
XML (AdES) |
XAdES (XML Advanced Electronic Signatures) signatures conforming to ETSI advanced electronic signature formats. Supported levels: -B, -T, -LT, -LTA |
|
|
|
Arbitrary data (CAdES) |
CAdES (CMS Advanced Electronic Signatures) signatures conforming to ETSI advanced electronic signature formats. Supported levels: -B, -T, -LT, -LTA |
|
|
|
Arbitrary data (CMS/PKCS#7) |
|
Generic CMS (PKCS#7) signer signs any document or file with support for encapsulated content or detached signatures and client-side hashing. |
|
|
All features of CMS Signer plus timestamping support. |
|
Code Signing
SignServer supports the following code signing formats:
|
Format / Artifact |
Worker |
Description |
Guide |
Enterprise |
|---|---|---|---|---|
|
Arbitrary data (raw signature) |
Produces a signature in the format determined by the configured algorithm, with no encapsulation. Supports client-side hashing. |
|
||
|
Signs arbitrary data and produces a CMS (RFC 3852) SignedData structure in binary format. Supports client-side hashing. |
|
|||
|
All features of CMS Signer plus timestamping support. |
|
|||
|
Windows PowerShell scripts ( |
Signs Powershell scripts. |
|
||
|
Microsoft Catalog files ( |
Signs Microsoft Catalog files. |
|
||
|
Windows PE files (
|
Signs portable executables according to the Windows Authenticode PE Signature Format. |
|
||
|
MSI installer packages ( |
Signs MSI installer packages. |
|
||
|
Cabinet archives ( |
Signs Cabinet archives. |
|
||
|
Windows PE files (CMS variant) |
Authenticode-compatible CMS signatures for embedding into PE files, MSI packages, and Cabinet archives. Supports client-side hashing. |
|
||
|
APPX / MSIX packages |
Signs Microsoft APPX packages and bundles. Supports client-side hashing. |
- |
|
|
|
CMS signatures for APPX packages and bundles. Based on Extended CMS Signer. |
- |
|
||
|
Java Archives ( |
Signs Java Archives and ZIP files according to the JAR File Specification in V1 scheme. |
|
||
|
Extended CMS Signer with defaults tuned for JAR signing. Supports client-side hashing. |
- |
|
||
|
Android packages ( |
Signs Android applications in APK schemes V1, V2 and V3. Includes a hash signer variant for client-side hashing. |
|
||
|
Debian packages ( |
Signs Debian packages in dpkg-sig format. |
- |
|
|
|
Signs Debian packages with debsigs. |
|
|||
|
Git commits |
Signs git commits and tags. |
|
||
|
OpenPGP |
Produces an OpenPGP (RFC 4880) detached signature in binary or ASCII-armored form, or a cleartext signature. |
|
||
|
Signs pre-hashed data using NONEwithX algorithms. For use with client-side hashing. |
|
Timestamping
SignServer can be used as the timestamp unit within a Time Stamp Authority (TSA) to generate digitally signed time stamps and includes monitoring of time synchronization, offering both RFC 3161 and MS Authenticode timestamps.
External References: RFC 3161, RFC 5816, ETSI EN 319 422
|
Format / Artifact |
Worker |
Description |
Guide |
Enterprise |
|---|---|---|---|---|
|
RFC 3161 timestamp tokens |
Issues RFC 3161-compliant timestamp tokens. SignServer can be operated as a TSA (Time Stamp Authority). |
|
||
|
RFC 3161 timestamps (extended) |
Extended timestamp signer with additional capabilities:
|
- |
|
|
|
Microsoft Authenticode timestamps |
Issues timestamps in Microsoft Authenticode format, for use during code signing workflows. |
- |
|
ePassport / Travel Documents
SignServer is used both for MRTD signing and for ICAO CSCA Master list signing:
|
Format / Artifact |
Worker |
Description |
Enterprise |
|---|---|---|---|
|
MRTD Security Object (SOd) |
Creates the Complete Security Object for Machine Readable Travel Documents (MRTD / ICAO ePassport) by signing the supplied data groups (DGs) with Logical Data Structure (LDS) version 1.7 and 1.8 support. |
|
|
|
CSCA Master List |
Produces a signed list of CSCA certificates according to the ICAO specification. |
|
DNS Zone Files
SignServer can be used to sign Domain Name System (DNS) zone files and zip files:
|
Format / Artifact |
Worker |
Description |
|---|---|---|
|
DNS zone file (server-side) |
Signs DNS zone files with server-side hashing. |
|
|
DNS zone file in ZIP (server-side) |
Signs DNS zone files packaged as a ZIP archive, with server-side hashing. |
|
|
DNS zone file (client-side hash) |
Signs pre-hashed DNS zone data. For use with client-side hashing workflows. |