Sign your code
After the certificate is on a USB eToken, KeyLocker, or HSM, use it to sign. These pages are thin examples—enough to finish setup—not a full CI/CD cookbook.
Always timestamp. A timestamp keeps the signature valid after the code signing certificate expires, as long as the timestamp authority is still trusted.
DigiCert timestamp URL: http://timestamp.digicert.com
In this section
Windows (SignTool)
Authenticode signing for .exe, .dll, .msi, .appx, and similar. USB eToken via SafeNet; Azure Key Vault via AzureSignTool.
Java (jarsigner)
Sign JARs with PKCS #11 (eToken or CloudHSM). Includes the legacy keytool “Input not an X.509 certificate” error.
Other signing paths
| Where the key is | Typical tools |
|---|---|
| USB eToken | SignTool + SafeNet, jarsigner + PKCS #11 |
| Azure Key Vault | AzureSignTool |
| AWS CloudHSM | SignTool/KSP or jarsigner PKCS #11 — AWS CloudHSM |
| DigiCert KeyLocker | DigiCert signing clients / smctl — KeyLocker docs |
Use SHA-256 (or stronger) for the file digest and timestamp digest. Do not ship SHA-1 Authenticode signatures on current Windows.