Skip to main content

Code Sign Client Overview

The Code Sign Client is the command-line tool that developers, release engineers, and CI/CD systems use to sync signing key references from the Next-Gen Trust Security (NGTS) code signing capability to a signing workstation. The keys themselves always stay in their secure storage location (AWS KMS or Built-In Key Storage), and the use of the keys is governed by the policies and TSG scope configured in NGTS.

The Code Sign Client includes native sign and verify capability, but these are intended primarily for testing purposes. For production signing, integrate the client with your preferred signing application (such as signtool, jarsigner, or cosign).

This section helps you install the client, authenticate it, and sync signing key references to your signing workstations. It also provides sample integrations for common code signing applications.

What you can do from here​

This section provides everything you need to begin using the Code Sign Client:

  • Install the client on a workstation
  • Authenticate using a Built-in Account (Client ID and key pair)
  • Configure client options (host URLs, proxy settings, logging, trace output)
  • List and sync Signing Keys
  • Perform a test signing and verification
  • Integrate signing into build tools and CI pipelines
  • Explore the full CLI reference

Administrative tasks — such as creating Signing Keys and Built-in Accounts — are performed in the NGTS UI and documented in the NGTS code signing product documentation.

Install the Code Sign Client​

You can download the Code Sign Client from the Client installation tab of any Signing Key in the NGTS UI.

Installers are available for:

  • Windows
  • macOS
  • Linux

Each download page also includes command-line installation instructions.

See Install the Code Sign Client.

Clients available for signing​

The Code Sign Client is available in two forms:

  • PKCS#11 client (pkcs11config) — available on Linux, macOS, and Windows
  • CSP/KSP client (cspconfig) — available on Windows only

Both clients provide the same signing capabilities and support the same command options. The primary difference is the underlying cryptographic provider they integrate with:

  • pkcs11config uses a PKCS#11 module for signing
  • cspconfig integrates with the Windows Cryptographic Service Provider (CSP) and Key Storage Provider (KSP) frameworks

Which client should I use?​

Most users and CI/CD systems can use the PKCS#11 client (pkcs11config) regardless of operating system. All examples in this documentation use pkcs11config for consistency.

If you are signing on Windows and prefer to use the CSP/KSP ecosystem, you may use the CSP/KSP client (cspconfig) instead of pkcs11config.

The examples in this documentation all use pkcs11config. Other than the command name itself, all other command options are identical between the two clients.

Authenticate the client​

The Code Sign Client authenticates to NGTS using a Built-in Account — a set of credentials (a Client ID and an authentication key pair) that a NGTS administrator creates for a signing user or automated system.

  • Not tied to an interactive user login
  • Works for both individual developers and non-interactive environments such as CI/CD pipelines
  • Uses a Client ID and a key pair; the key pair can be generated in the NGTS UI or on the signing machine
  • The account is scoped to a TSG, and can access the Signing Keys within that TSG (and its child TSGs)

See Authenticate using a Built-in Account.

Test signing​

After authentication, you can verify that everything is working correctly:

  • List available Signing Keys
  • Sign a file
  • Verify a signature

See Perform a test signing.

Explore the CLI​

The Code Sign Client includes a complete CLI for inspecting configuration, performing signing operations, verifying signatures, and troubleshooting.

See Code Sign Client CLI reference.

Sample integrations​

The Code Sign Client can be integrated with common build tools and CI systems. Because it exposes keys through standard cryptographic interfaces (PKCS#11 or CSP/KSP), it works with any signing tool that supports those interfaces.

A reference integration demonstrating best practices is available in Sample Integrations.

Next steps​

Once your client is installed and authenticated:

  • Integrate the Code Sign Client into your build or release workflow
  • Use sample integrations as templates
  • Explore advanced client configuration
  • Set up secure storage for Built-in Account credentials in CI environments