Certum SimplySign · Authenticode

Sign Windows executables with Certum SimplySign, from Linux, macOS or Windows

ssign is a free, open-source command-line tool that Authenticode-signs Windows binaries with your Certum SimplySign cloud certificate. It talks to the SimplySign cloud over HTTPS by itself: no SimplySign Desktop, no GUI, no container, no PKCS#11 stack. One command, on your own machine or in CI.

ssign -e you@example.com -T 123456 app.exe

Download ssign Get started

The problem

With a SimplySign certificate, the private key stays in Certum's cloud HSM (hardware security module); signing happens remotely. Certum's client application, SimplySign Desktop, holds the login session and makes the calls to the cloud. Its PKCS#11 module has no network code of its own: it only relays requests to the running, logged-in desktop application. On a headless server or a CI runner, the workaround has been to run SimplySign Desktop in a container with a virtual display (Xvnc) and p11-kit, as certum-container does.

What ssign does instead

Authenticode signing is just data: hash the file, have the cloud sign, wrap the RSA signature into a PKCS#7 blob. ssign does every step itself, so a Linux laptop or an ubuntu-latest runner can sign a Windows binary:

Certum cloudLog inOAuth login with your e-mail and a 6-digit one-time code → bearer token
Certum cloudFetch the cardcard serial and signing certificate
Your machineHashAuthenticode SHA-256 of each file
Certum cloudRequest the signaturethe digest and the certificate → asynchronous task
Certum cloudPoll→ RSA-4096 signature
Your machineAssemble and embedPKCS#7 + certificate chain + RFC 3161 timestamp, written into the file

Get started

Sign your first file →

GitHub Actions

A signing workflow, gated so that the repository owner approves every run.

PKCS#11 module

MSI, CAB, catalogs, APPX and PowerShell scripts through osslsigncode.

Every format →

Security

What is sent where, what is cached on disk, and why the TOTP seed is a long-lived secret.

How it works →

What it signs

Does	Does not (yet)
Authenticode-signs PE files: `.exe`, `.dll`, `.sys`, `.ocx`, `.cpl`	MSI / MSP / MSM in the `ssign` command (work in progress; use the PKCS#11 module)
Embeds the full certificate chain (your certificate + the Certum intermediate)	CAB, catalogs (`.cat`), PowerShell scripts, APPX/MSIX in the command itself (the module covers them)
Adds an RFC 3161 timestamp (`time.certum.pl`)	Signing with anything other than a Certum SimplySign cloud certificate
Runs on Linux, macOS, Windows; signs many files with one login	Verifying signatures (use `signtool` or `osslsigncode`)

It works end to end for PE files, proven in CI: ssign produces a valid Authenticode signature with the real Certum cloud certificate, the full chain and an RFC 3161 timestamp. ssign's own Windows release is signed with ssign, from a Linux runner.

Runs on

Linux (x86_64 and ARM 64-bit), macOS (Apple silicon and Intel) and Windows (64-bit): prebuilt downloads.
Or with Rust installed: cargo install ssign.

Free software, built in the open

ssign is written in Rust and released under the MIT licence. The source code, the releases and the issue tracker are on GitHub. Native support for more formats (MSI, CAB, catalogs, APPX/MSIX, scripts) is welcome as contributions. Questions, bug reports or beta testing: join the Discord.