4.90.1 4.80.4 4.80.1 4.70.1 4.60.3 4.60.2 4.40.2 4.40.1 4.30.4
4.90.1 4.80.4 4.80.1 4.70.1 4.60.3 4.60.2 4.40.2 4.40.1 4.30.4
Breadcrumbs

Signum Agents

Signum Agents are lightweight components that bridge native operating system signing capabilities with the Signum SaaS platform.

Agent Overview

The Signum Agents work by leveraging platform-native cryptographic interfaces, such as:

  • Windows: Key Storage Providers (KSP), Cryptographic Service Providers (CSP), and PKCS#11.

  • macOS: PKCS#11 and Keychain using CryptoTokenKit

  • Linux: PKCS#11

For more information, see Interoperability.

As of the 4.90.1 release, a new version of the Windows Agent is available for download, with extended functionality and streamlined installation capability. The Agent is compatible with x64 and ARM Windows machines. For information and configuration of the legacy Windows Agent, see Legacy Windows Agent.

Download the Agent packages for Windows (.msi), macOS (.pkg), and Linux (.deb, .rpm) from the Signum SaaS Portal.

Signum also offers a container-based version of the Linux Agent. For access, contact Keyfactor support.

Once authenticated through an Agent, users or machines gain access to certificates governed by the roles and policies defined in Signum.

Outbound access to port 443 on the Signum server instance is required. Ensure your firewall permits this connection.

For guides on signing with these Agents, see Signing Guides.

Agent Tools

After installation, the following tools are available for the Agent:

Signum Util

The Agent is set up and configured using the Signum Util tool. Based on the OS, the installer adds the tool to the following location and to the users path:

OS

Location

Windows

C:\Program Files\Keyfactor\Signum\setup

macOS

/usr/local/bin/signum-util

Linux

/usr/bin/signum-util

For instructions, see Configure & Authenticate Agent.

The legacy Windows agent uses the rtsetup.exe tool for configuration. See Legacy Windows Agent.

Signum Service

The Signum Service is the background service that serves as bridge between the crypto libraries and the Signum server. Based on the OS, the installer adds the tool to the following location:

OS

Location

Windows

C:\Program Files\Keyfactor\Signum\service

macOS

/usr/local/bin/signum-util/service

Linux

/usr/bin/signum-util/service

The legacy Windows agent uses the RTService tool. See Legacy Windows Agent.

PKCS#11 Module

After installation, the Agent PKCS#11 module, which is needed for configuring different signing tools, can be found in the following locations:

OS

Location

Windows

\Windows\System32\libsignumpkcs11.dll

macOS

/Library/Keyfactor/Signum/lib/libsignumpkcs11.so

Linux

/usr/lib/libsignumpkcs11.so

Other OS-specific Tools

The following tools are also included, based on the OS of your Agent:

OS

Tool

Functionality

Windows

KSP/CSP

The KSP or CSP tools make HSM-backed certificates visible in the Windows certificate store.

macOS

KeyfactorAgentToken

This is the CryptoTokenKit, which makes Signum
HSM-backed keys appear as locally available identities to these tools.

SignumAgent App

This is a Basic UI that registers the KeyfactorAgentToken.appex extension.

Agent Logs


The Agent and tool logs are found in the following locations:


Log Location

Description

Windows Agent:

~\AppData\Local\Temp\*[Ss]ignum*

Log files for the SignumService and signum-util.

macOS/Linux Agent:

/tmp/*[Ss]ignum*

Log files for the SignumService and signum-util.

UI:

~/Library/Group Containers/group.com.keyfactor.signum.shared/keyfactoragent.log

Log for the UI interface.

Token:

~/Library/Group Containers/group.com.keyfactor.signum.shared/keyfactoragenttoken.log

Log for the token being invoked by the applications using the keychain's certificates.

PKCS#11 & KSP:

~/.keyfactor/logs

The PKCS#11 and KSP logs have one file per calling process.

Cryptotokenkit (macOS):

~/Library/Group Containers/group.com.keyfactor.signum.shared

Log for Cryptotokenkit usage.


Logs for the legacy Windows Agent can be extracted from C:\Windows\Temp in the redtrustclient.txt file.

Logging is off by default (NONE). Log level options are NONE, LOW, MEDIUM, or HIGH.

Configure the log levels in two independent places:

  • Agent log level configuration:

    signum-util service -l <level> -t <FILE or STDOUT> -r

  • CLI log level configuration:

    signum-util setup -l <level>

Viewing Agent Details

In the Agent tab of the Admin Web Console System page, you can view details of your agent, including:

  • Machine Information: Hardware and OS details of the machine where the Agent is installed.

  • General Information: Recent session activity for the Agent.

  • Certificates: Certificates associated with the Agent.

  • Signum Users: Every user that has authenticated to this Agent.