Using SignServer with Signum

SignServer extends Signum's signing capabilities with more advanced features. With SignServer, you gain access to post-quantum cryptography (PQC) algorithms, trusted timestamping through a built-in TSA, and programmatic signing workflows through the SignServer REST API and SignClient CLI.

The Signum Agent connects to SignServer rather than the default HSM, forwarding signing requests for processing. The existing signing tools and workflows continue to work without modification.

This section covers configuration and operation specific to the SignServer backend mode. For a conceptual overview of how Signum and SignServer relate, see Signum Architecture & Concepts.

The full reference for SignServer is available in the SignServer Documentation.

SignServer Interfaces

When SignServer is configured as the backend, the following interfaces are available for advanced configuration and signing operations. These are separate from the Signum Admin Web Console and are accessed directly.

SignServer Admin Web

The SignServer Admin Web is the graphical interface for configuring Workers and managing associated keys. It is the primary tool for advanced Crypto Worker setup that goes beyond what the Signum Admin Web Console exposes.

You can access the Admin Web from the Portal Dashboard in the SaaS Portal.

For more information, see Admin Web in the SignServer documentation.

REST API

The SignServer REST Interface is a RESTful web service for programmatic integration with signing operations. Use it to create a Crypto Worker, submit signing requests, and automate workflows.

For endpoints and usage, see REST API Interface in the SignServer documentation.

SignClient

SignClient is the SignServer CLI tool for submitting signing and timestamp requests, testing Worker configurations, and scripting signing in automated pipelines.

Download SignClient from Signum Links in the SaaS Portal.

Using SignServer Endpoints

Each Signum+ deployment includes SignServer endpoints, found in Signum Links.

Find your deployment name and region on the Portal Dashboard.

Worker Endpoint

The Worker endpoint is used for signing operations. Use the endpoint for your tools and pipelines to submit requests to a configured Worker. To target a specific Worker, append the Worker name or ID to the base URL:

https://signserver.<deployment-name>.<region>.az.keyfactorsaas.com/<WorkerNameOrID>

For example, if you have configured a Plain Signer named PlainSigner, a process request would be sent to:

https://signserver.mydeployment.se.az.keyfactorsaas.com/PlainSigner

View the Worker logs in the Log Viewer. Worker logs from this endpoint are useful for troubleshooting signing errors or authentication issues with SignClient.

Worker Certificate Authentication Endpoint

The Worker Certificate Auth endpoint is the MTLS-supported alternative to the Worker endpoint.

Use the endpoint for situations involving client certificate authentication such as sending requests to SignServer or setting up an Agent with certificate authentication.

Admin Endpoint

The Admin endpoint is used for administrative operations, such as configuration changes or sending requests which require authentication. Additionally, the URL provides access to the SignServer Admin Web.

View the Admin logs in the Log Viewer. Admin logs from this endpoint are useful for investigating errors in the Admin Web or during Worker configuration.

Interoperability

For an overview of SignServer interoperability such as supported HSM and algorithms, see Interoperability in the SignServer documentation.