.png){kind=logo}
The Signum Windows Agent provides an authenticated user access to signing certificates from the Signum Server and a connected HSM for use with signing tools that support working with Microsoft’s API for Key Storage Providers (KSP) and also the older Microsoft’s older Cryptographic Service Provider (CSP). Examples include Sign Tool, Jarsigner, Nuget Signer, and VSIX signer.
For instructions on using different third-party signing tools with the Windows Agent, see Signing Guides.
Prerequisites
-
Microsoft Windows 11 (64 bits)
-
Windows Server 2019 and later (64 bits)
-
Outbound access to port 443 on the Signum server instance.
-
A firewall rule permitting this outbound connection (if applicable).
-
-
Microsoft Visual C++ 14.29.30133 (The installer will prompt and download this automatically unless configured for a silent/quiet)
-
NetFramework 4.8
-
Administrator privileges during install
To use PKCS#11, the Windows Agent in must be version 4.30.1 or higher. See Supported Versions.
Agent Modes
There are two different modes the Windows Agent can be installed in: an interactive mode with a user interface called User Mode (Attended), or a CLI configuration called Server Mode (Unattended).
User Mode
Server Mode
Intended use:
End users
Automation, service accounts, CI/CD scenarios
Operation:
Interactive UI
Command-line
Authentication methods:
SAML domain, OAuth domain, Local Users
Local Users, Certificate
Installation parameter:
AGENTMODE=”USER”
AGENTMODE=”SERVER”
Certificate storage:
User store
User or Machine store
System tray icon:
Available
Unavailable
Installation
To install the Windows Agent, run a .bat file setup with initial configuration parameters targeting, or in the same directory as, the Signum Agent .msi installer.
The following shows the basic format configuration_parameter_key="some_value":
AuthMode="LocalUsers"
The following is an example .bat file that installs a particular version of the Signum Windows Agent .msi in USER mode with an interactive UI configured to use a SAML provider for authentication:
msiexec /i kf-agent-x64-4.30.1-456b2f45-MS-WO_Trust.msi ^
RTPRIMARY="Deployment URL" RTSECONDARY="Deployment URL" ^
CLIENTID="The ClientID from the SaaS Portal" ^
AuthMode="SAML2" AGENTMODE="USER" DefaultDomain="somedomain.com" ^
Language="en-US" ^
echo Exit Code is %errorlevel%
Installation Parameters
The following parameters are available during installation:
|
Parameter |
Default Value |
Description |
Required |
||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
None |
Provide the primary Signum Server URL, without https://. Example: |
|
||||||||||||||||||||
|
|
None |
Copy the information used in the This feature is for a legacy model of backup server and will be removed as a required argument from future versions of the agent. Example: |
|
||||||||||||||||||||
|
|
None |
Unique value for the Signum Instance. This can be obtained from Keyfactor during deployment. |
|
||||||||||||||||||||
|
|
None |
Specify what Domain type users are authenticating from:
Certificate mode requires additional setup. See Authenticate With Certificate. |
|
||||||||||||||||||||
|
|
|
Run the Agent in User Mode or in Server Mode. Valid options are:
The |
|
||||||||||||||||||||
|
|
None |
For users connecting from SAML or OAuth domains, set parameter to the name of the domain. |
|
||||||||||||||||||||
|
|
None |
Specify the Agent language. Available options are:
|
|
||||||||||||||||||||
|
|
|
Set to This setting can be useful if you want the highest Agent performance and are not using older applications. The |
|
||||||||||||||||||||
|
|
|
Set to Only available for User Mode. |
|
||||||||||||||||||||
|
|
|
Set to This can be useful in situations where the Agent is included in a base VM Image to prevent the same AgentID from being generated and duplicated across different images. Only available for Server Mode. |
|
Additional Parameters
|
Parameter |
Default Value |
Description |
Required |
|---|---|---|---|
|
|
|
Only available for User Mode. |
|
|
|
|
Only available for User Mode. |
|
|
|
|
Seconds of timeout after which the Agent considers that the server is not available. |
|
|
|
|
Specifies the operating mode of the installed service. If set to delayed start, the Agent will attempt to be the last process to start on boot.
|
|
|
|
|
Number of seconds before the user must re-enter a PIN. This only applies to a single Cryptographic session. |
|
|
|
|
|
|
|
|
None |
Can be used to optionally configure a proxy. The proxy must be transparent with no authentication, in the format of a URL. |
|
Adjust Settings
Once the Agent is installed, many of the parameter settings and the optional registry settings can be changed by editing the registry at:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Evolium\Redtrust
Settings for the KSP and between User and Server Modes need to be set at installation time and cannot be updated later to new values.
Optional Registry Settings
These properties cannot be passed at installation but can be set directly in the registry. By default, the Agent can dynamically change these to avoid conflicts with other running processes.
|
Parameter |
Default Service |
Description |
Required |
|---|---|---|---|
|
|
|
CSP module and RTTrayApp use this port to communicate to the local service. If the default port is unavailable, another one can be configured. Only set if a specific port is needed, otherwise it will be assigned automatically. |
|
|
|
|
KSP module uses this port to communicate to the local service. If the default port is unavailable, another one can be configured. Only set if a specific port is needed, otherwise it will be assigned automatically. |
|
After making changes, restart the System service that is running “RTService”.
In User Mode, it may also be necessary relaunch the tray application. To do this, end the “RTTrayApp” process in Task Manager and then relaunch by running the “RTTrayApp” found in C:\Program Files\KeyFactor.