ssign Version française

Sign every format: the PKCS#11 module for osslsigncode

The ssign command signs PE files (.exe, .dll, .sys…). For every other Authenticode format (MSI, CAB, catalogs, APPX, PowerShell), ssign also ships a PKCS#11 module, ssign-pkcs11, that hands your Certum cloud key to osslsigncode, which already knows how to hash and package them all. Still no SimplySign Desktop, no p11-kit, no smart card: the module talks to the cloud over HTTPS like the rest of ssign.

1. Get the module

2. Install osslsigncode

osslsigncode needs either the OpenSSL PKCS#11 provider or the libp11 engine: it loads pkcs11prov if present and falls back to the engine. Both work with the module. On Debian or Ubuntu:

apt-get install osslsigncode libengine-pkcs11-openssl

3. Get the Certum intermediate certificate

The -ac option embeds the Certum “Code Signing 2021 CA” intermediate so that the chain verifies. The repository ships it in DER form as ssign-core/src/certs/ccsca2021.der; convert it to PEM with OpenSSL:

openssl x509 -inform DER -in ccsca2021.der -out certum-code-signing-2021-ca.pem

4. Sign

cargo build -p ssign-pkcs11 --release   # → target/release/libssign_pkcs11.so

export CERTUM_EMAIL=you@example.com CERTUM_OTP=BASE32SEED
osslsigncode sign \
  -pkcs11module ./target/release/libssign_pkcs11.so \
  -pkcs11cert 'pkcs11:type=cert' -key 'pkcs11:type=private' \
  -ac certum-code-signing-2021-ca.pem \
  -h sha256 -t http://time.certum.pl/ \
  -in installer.msi -out installer-signed.msi

Use the path of the module you downloaded or built. The module reads the same CERTUM_EMAIL and CERTUM_OTP (or CERTUM_TOKEN, a current 6-digit code) as the command.

The module presents a single certificate and a single private key, both labelled Certum SimplySign (ssign), so pkcs11:type=cert and pkcs11:type=private are enough. The repository's test script names them by label:

pkcs11:object=Certum%20SimplySign%20%28ssign%29;type=cert
pkcs11:object=Certum%20SimplySign%20%28ssign%29;type=private

Many files, one code

osslsigncode reloads the module for every file, and Certum accepts each code only once. The module therefore caches the cloud session (the same cache as the ssign command), so signing many files in a row needs only one code. You can sign your PE files with ssign, then your MSI with osslsigncode, with a single login. See the session cache.

Tested end to end

ssign-pkcs11/tests/sign-all-formats.sh signs and verifies one file of each of these formats through the module and osslsigncode: .exe, .dll, .msi and .ps1. CAB, CAT and APPX work too once you give it a sample file, since osslsigncode signs them; the script just does not generate them. From a clone of the repository, with the module built:

CERTUM_EMAIL=you@example.com CERTUM_OTP=SEED \
  ssign-pkcs11/tests/sign-all-formats.sh

Limits