Version françaiseQuestions and answers
Common questions about ssign and Certum SimplySign code signing. Something missing? Ask on Discord.
Can I use a Certum SimplySign certificate on Linux without SimplySign Desktop?
Yes. ssign talks to the SimplySign cloud over HTTPS by itself: it logs in, fetches your certificate and asks the cloud to sign, with no SimplySign Desktop, no GUI, no container and no PKCS#11 stack. It runs on Linux, macOS and Windows. See Get started.
Do I need Windows to sign a Windows .exe?
No. Authenticode signing is data: ssign hashes the file, gets the RSA signature from the cloud and builds the PKCS#7 signature itself, with no Windows API. ssign's own Windows release is signed that way, from a Linux runner.
Can I sign in GitHub Actions or another CI?
Yes. Give ssign CERTUM_EMAIL and the TOTP seed in CERTUM_OTP, and it computes the one-time code on each run. Keep the seed in a protected environment that needs your approval: see GitHub Actions.
Which file types can it sign?
The ssign command signs PE files: .exe, .dll, .sys, .ocx, .cpl. For MSI, CAB, catalogs, APPX and PowerShell scripts, use the PKCS#11 module with osslsigncode. Native MSI signing in the command itself is still in progress.
What is the TOTP seed, and do I have to store it?
It is the base32 secret behind the authenticator you set up from the SimplySign QR code. It is long-lived: with it and your e-mail, anyone can sign as you until you re-issue the QR code. You only need it for automation (--otp). On your own machine, pass the current code with --token instead, and the seed never leaves your authenticator app. See Security.
Login fails with “no authorization code after login — wrong e-mail or OTP?”
Certum did not accept the e-mail and code. Check the e-mail, and that the code is current: a code is valid for about 30 seconds and Certum accepts it only once. With --otp, ssign computes the code from the system clock, so that clock has to be right.
I sign several files, or run ssign several times. Do I need a new code each time?
No. One login signs every file given on the command line. The session is also cached for 20 minutes, so the next runs, and the PKCS#11 module, reuse it without a new code. See the session cache.
ssign says “file already has a signature”.
ssign does not replace an existing Authenticode signature: it stops on a PE file that is already signed. Sign the file as it came out of the build.
Does ssign verify signatures?
No. Check the result with osslsigncode verify or with signtool on Windows. ssign's own release pipeline checks every signed file with osslsigncode verify.
Does it work with other certificate authorities or a hardware token?
No. ssign signs only with a Certum SimplySign cloud certificate.
Does ssign run in a minimal Docker image?
It needs no SimplySign software, but it checks HTTPS certificates through the operating system's certificate store. The image must therefore contain CA certificates: a bare scratch container has none.
SimplySign Desktop keeps looping on the login page.
That is a SimplySign Desktop issue, recorded while the protocol was studied: version 2.9.10 gets an HTTP 415 error in a tight loop when it lists the cards, so the card is never inserted and the login page loops; version 2.9.14 speaks the current API. ssign does not use SimplySign Desktop at all. Details in the protocol notes.
Is ssign an official Certum tool?
No. It is an independent open-source client for the SimplySign cloud, not affiliated with or endorsed by Certum / Asseco.
Where can I ask a question or report a bug?
On Discord or in the GitHub issues.