How to Automate EV Code Signing With SignTool.exe or Certutil.exe Using eSigner CKA (Cloud Key Adapter)

eSigner CKA (Cloud Key Adapter) is a Windows application that uses the CNG interface (KSP Key Service Provider) to enable certutil.exe and signtool.exe to perform code signing operations via the eSigner CSC API.

Functioning as a virtual USB token, it securely loads code signing certificates into the Windows certificate store without requiring physical hardware. As a cloud-based signing method, eSigner CKA eliminates the cost, logistical challenges, and security risks of USB tokens while providing enterprise-grade signing capabilities without the complexity of networked HSMs. This makes it a scalable, secure, and cost-effective solution for modern code signing workflows.

This guide covers manual and automated code signing on Windows using SignTool with production or test certificates. Unlike physical tokens, eSigner CKA supports advanced automation, enabling seamless integration with CI/CD tools such as GitHub Actions, GitLab CI, CircleCI, and Travis CI. If you are using a CI/CD tool, see this related guide: How to Integrate eSigner CKA with CI/CD Tools for Automated Code Signing.

Requirements

1. A Code Signing certificate issued by SSLcom. 
2. Code Signing certificate must be currently enrolled on eSigner. Refer to this guide: Enroll with eSigner for Remote Document and Code Signing
3. Install eSigner CKA on your computer and configure the mode of signing (manual or automated ) and the type of signing (production or test). Refer to this article for installation instructions: How to Install SSL.com eSigner Cloud Key Adapter (CKA).

Optional Procedure: Use Pre-Signing Malware Scan

Malware Scan is a crucial service from SSL.com that ensures software is free of malware before it is signed with a code signing certificate. By integrating Malware Scan, developers add a robust layer of security, automatically halting the signing process if malware is detected and alerting the developer to take necessary actions.

Instructions:

1. Login to your SSL.com account. Click the orders tab followed by the download link of your certificate to display its details. Scroll down to the SIGNING CREDENTIALS section and locate the part showing your eSigner certificate credentials. Make sure that the radio buttons that say signing credential enabled and malware blocker enabled are chosen.
2. Install eSigner Cloud Key Adapter.
3. Install eSigner CodeSignTool. Click here to download eSigner CodeSignTool.
4. Scan the code on CodeSignTool using the following command: scan_code [-hV] -input_file_path=<inputFilePath> -password=<PASSWORD> [-program_name=<programName>] -username=<USERNAME>
5. Use SignTool to sign the code with eSigner CKA using the following command: scan_code -username=<USERNAME> -password=<PASSWORD> -credential_id=<eSigner Credential ID> -input_file_path=<inputFilePath>

Parameters:

• -input_file_path=<PATH>: Path of code object to be signed.
• -username=<USERNAME>: SSL.com account username
• -password=<PASSWORD>: SSL.com account password.
• -program_name=<PROGRAM_NAME>: Name of program
• -credential_id=<CREDENTIAL_ID>: Credential ID for signing certificate. Your eSigner Credential ID is located in your SSL.com certificate order page.

Formulate the Command for Signing Code

Components of the Comand

For both manual and automated code signing, the command contains:

1. The location of SignTool (command-line tool that is responsible for digitally signing a file and verifies the signature), enclosed in double quotation marks. Example: “C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\signtool.exe”
   Note: Location of SignTool will depend on the version of the SDK downloaded and the architecture being used.
2. The /fd sha256 option which specifies the Hash Algorithm
3. The /tr http://ts.ssl.com option which specifies the timestamp server address
4. /td sha256 option which specifies the timestamp digest algorithm
5. The /sha1 option which specifies the thumbprint that SignTool uses to find the appropriate code signing certificate from the key store
6. The actual certificate thumbprint
7. The path of the file that will be signed, enclosed in double quotation marks: “SIGNABLE FILE PATH”

Over-all the command should look like the following: 

“C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\signtool.exe” sign /fd sha256 /tr http://ts.ssl.com /td sha256 /sha1 certificate thumbprint “SIGNABLE FILE PATH”. 

Locating your Certificate Thumbprint

Later, upon installing eSigner CKA and adding your EV Code Signing certificate to the User Certificate store, you will be able to check your EV Code Signing certificate thumbprint by pressing Windows key + R and then type in certmgr.msc to access the User Certificate store. When the certificate manager window pops up, click the Personal folder on the left panel and then select the Certificates subfolder on the right to locate your EV Code Signing certificate.

Double click the certificate. Select the Details tab and then scroll down to reveal the Thumbprint. Copy the Thumbprint and include it into your command when you are signing code.

Go to top

Manual Code Signing

Install eSigner CKA

Access SignTool via the Command Line

To recall, the command for code signing looks like the following: 

“C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\signtool.exe” sign /fd sha256 /tr http://ts.ssl.com /td sha256 /sha1 certificate thumbprint “SIGNABLE FILE PATH”

Upon writing the command and pressing Enter, you will see the message Done Adding Additional Store. A window will then pop-up requiring you to place your SSL.com account username and password.

Enter the One Time Password (OTP) 

A One Time Password (OTP) for your eSigner-enrolled EV Code Signing Certificate will be sent to your Authenticator app. Upon successful input, Command Prompt will indicate that your file has been successfully signed.

Success! Your code is now signed. 

Check the Digital Signature on the File

After successful code signing, you can now check the details of the digital signature on the file. Right-click the signed file, click Properties, followed by the Digital Signatures Tab. Here you will see the name of the Signer, the digest algorithm used, and the timestamp of the signature. Click the Details button to get more information about the signed code.

You will be able to read the information stating This digital signature is OK. Proceed to click the View Certificate button.

After clicking the View Certificate button, you will read information indicating that the Digital Certificate issued for the signed file ensures that it came from the publisher and protects it from alteration after publication.

Go to top

Automated Code Signing

Access SignTool via the Command

To recall, the command for code signing looks like the following: 

C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\signtool.exe” sign /fd sha256 /tr http://ts.ssl.com /td sha256 /sha1 certificate thumbprint “SIGNABLE FILE PATH”

Open Command Prompt and place the command. After pressing enter, you will see the notice saying Done Adding Additional Store.

After a few seconds, you will see the notice Successfully signed. This indicates that your file has been signed in an automated manner, without the additional need for OTPs. 

Check the presence of the digital signature on your file

Open the folder location of your signed file. Right-click it and then click Properties. Click on the tab Digital Signatures and here you will see the secure hash algorithm used has 256 bits. Click the immediate space showing the name of the signer, digest algorithm, and Timestamp. After it gets highlighted, proceed to click the Details button.

A pop-up window will then show stating that the digital signature on the file is valid as well as indicating the specific time when it was signed. Click the View Certificate button to see more information about the EV Code Signing digital certificate that was issued. 

You will see information about the EV Code Signing certificate stating that it validates you as the creator of the executable and protects your file from being tampered with. 

Go to top

Related Code Signing Guides using eSigner CKA

• Signing Hardware Lab Kit (HLK) Files – Use eSigner CKA with HLKSigntool to test and prepare kernel-mode drivers for Microsoft submission. Integration with Microsoft’s HLK platform requires HLKSigntool.
  
• Signing VBA Macros – Learn how to sign Microsoft Visual Basic for Applications (VBA) macros, which automate tasks within Office applications without requiring programming expertise.
  
• Signing .app Files – Sign .app files to securely define and reference the identity of a complete Microsoft application solution.
• Signing .vsix Files – Sign .vsix installer packages for Visual Studio extensions and add-ons, ensuring integrity and authenticity for IDE components.

Need more information on Cloud-Based Signing? 

1. eSigner: Code Signing as a Service
2. Cloud Code Signing Automation with CI/CD Services