Breadcrumbs

Introduction

Keyfactor Signum+ is a unified code signing and key management platform that brings together Signum and SignServer into a single, integrated SaaS solution. It provides organizations with centralized control over digital signing operations, cryptographic key lifecycle management, and Hardware Security Module (HSM) connectivity, all delivered as a managed cloud service.

What is Signum+?

Signum+ combines two platforms:

  • Signum: A certificate and key management platform with a web-based admin console, multi-platform client agents (Windows, macOS, Linux), and fine-grained access controls for managing who can sign with which keys.

  • SignServer: A server-side signing framework that performs code signing, document signing, timestamping, and ePassport operations using Workers.

In Signum+, Signum and SignServer use the same HSM for connecting cryptographic material. This architecture allows for shared keys between both Signum and SignServer, simplifying key management. Signum+ brings both platforms together in a single deployment, providing the best of each: Signum's intuitive admin console for user management, certificate lifecycle, and policy controls, alongside SignServer's dedicated admin interface for advanced Crypto Worker configuration and signing operations. As the platform evolves, these experiences will converge into a single unified console.

For more information, see https://keyfactor.atlassian.net/wiki/x/dYAdsw.

Key Capabilities

Signing Operations

  • Code signing: Sign executables, libraries, drivers, and packages across platforms.

  • Native signing tools: Seamless integrations leveraging KSP, CSP, PKCS#11, or Keychain (CryptoTokenKit).

  • Document signing: Digitally sign PDFs and other document formats.

  • Timestamping: Cryptographically prove when a signature was created, which can be powered by SignServer's timestamp authority.

  • CI/CD integrated signing: Incorporate Signum-based signing directly into automated build and release.

For more information, see Integration & Signing Guides.


Multi-Platform Client Agents

Signum Agents are installed on the systems that perform signing:

  • Windows Agent: Integrates with Microsoft SignTool via KSP and PKCS#11.

  • Linux Agent: Works with OpenSSL, jarsigner, cosign and other tools via PKCS#11.

  • macOS Agent: Integrates with Keychain and supports PKCS#11 for codesign and other utilities.

The Signum Agents support unattended interfaces for CI/CD signing workflows.

For more information, see Signum Agents.


Access Control, Key Management, and Audit

The Signum Admin Web Console is the central control point for the platform. Administrators use it to:

  • Assign users and groups to roles, permissions, and policies that define certificate access.

  • Authenticate administrators via OAuth with your organization's Identity Provider.

  • Generate key pairs and Certificate Signing Requests (CSRs) directly on HSMs. Including the ability to generate key attestation packages.

  • All agent activity is logged and exportable to Syslog or Splunk for compliance and audit.

To configure Signum, use the Signum Admin Web Console.


If you have questions or would like to learn more about Signum or other Keyfactor products and services, please Contact Us.