Sign a Windows executable on Linux with Certum SimplySign

The same commands work on Linux, macOS and Windows. You need your Certum account e-mail and your authenticator app. Download ssign first if you have not already.

1. Choose how to log in

The SimplySign cloud login takes your e-mail and a 6-digit one-time code, not a password. Give ssign exactly one of these:

Mode	Option	When
Manual	`-T`, `--token <CODE>`	On your own machine: read the current code from your authenticator app and pass it.
Automatic	`-O`, `--otp <SEED>`	CI and scripts: give your TOTP seed once, and ssign computes the 6-digit code on every run.

The seed is a long-lived secret. With your seed and your e-mail, anyone can sign code as you until you re-issue the SimplySign QR code. Never pass it as a command-line argument; use the CERTUM_OTP environment variable, and prefer --token when you sign by hand. Read the security notes.

2. Sign

# Manual, local — paste the current code from your app:
ssign -e you@example.com -T 123456 app.exe

# Automation — seed once, then hands-off:
export CERTUM_EMAIL=you@example.com
export CERTUM_OTP=YOUR_BASE32_TOTP_SEED       # or the full otpauth:// URI
ssign app.exe installer.dll driver.sys

Files are signed in place by default. --backup keeps the original as <file>.orig; -o <DIR> writes the signed files to another folder instead. ssign prints signed <file> for each file; add -v to see each step.

3. Check the result

ssign does not verify signatures. Use osslsigncode verify app.exe, or signtool on Windows.

All options

Option	Environment variable	What it does
`FILES`	–	Files to sign. Signed in place unless `-o` is given.
`-e, --email <EMAIL>`	`CERTUM_EMAIL`	Certum account e-mail. Required.
`-O, --otp <SEED>`	`CERTUM_OTP`	TOTP seed (base32, or a full `otpauth://` URI): ssign derives the 6-digit code itself. For CI and automation.
`-T, --token <CODE>`	`CERTUM_TOKEN`	A current 6-digit code from your authenticator app. For a one-off manual signing.
`-o, --output-dir <DIR>`	–	Write signed files to this folder (created if needed) instead of overwriting them.
`--timestamp-url <URL>`	–	RFC 3161 timestamp authority. Default: `http://time.certum.pl/`.
`-n, --name <TEXT>`	–	Signature description embedded in the file.
`-u, --url <URL>`	–	Signature info URL embedded in the file.
`--backup`	–	When signing in place, keep the original next to it as `<file>.orig`.
`-v, --verbose`	–	Print each step (login or cached session, card, each file).
`-h, --help / -V, --version`	–	Show the help or the version.

Only the e-mail, the seed and the code can come from environment variables. Prefer them for secrets: a value passed on the command line is visible in your shell history and in the process list. Passing both --otp and --token is an error.

The seed: base32 or otpauth:// URI

--otp accepts a bare base32 secret or a full otpauth:// URI. With a bare secret, ssign uses SimplySign's settings: SHA-256 (not the SHA-1 default of most TOTP libraries), 6 digits, 30 seconds. With a URI, the algorithm, digits and period are read from the URI. The code is computed from the system clock.

One login for many files

ssign logs in once per run and signs every file you list with that session. It also saves the session for 20 minutes, so the next runs within that time, and the PKCS#11 module, sign without a new code. That matters because Certum accepts each code only once. Where the session is stored and what that means: the session cache.

Good to know

ssign will not sign a PE file that already carries a signature (“file already has a signature”).
With --backup, an existing .orig file is never overwritten: the run stops and the file is left as it was.
The signed file is written to a temporary file and then swapped in, and it keeps the permissions of the file it replaces.
-n and -u embed a description and an information URL in the signature.

Signing in a pipeline? Continue with GitHub Actions.