Skip to main content

Perform a test signing

After installing and authenticating the Code Sign Client, you can perform a simple test signing to confirm that everything is working correctly. This page walks you through listing available Signing Keys, signing a file, and verifying the signature.

Before you begin​

Make sure:

  • The Code Sign Client is installed on your workstation or build machine.
  • The client is authenticated using a Built-in Account.
  • The Built-in Account is scoped to a TSG that contains at least one Signing Key.

All examples use the pkcs11config utility. If you are using the CSP/KSP client on Windows, replace pkcs11config with cspconfig.

List available Signing Keys​

Run the following command:

pkcs11config list

This lists the objects (certificates and keys) available to your authenticated Built-in Account.

Example output:

Certificate 1:
Label:       Release Signing Key
Subject:     CN=Release Signing Certificate
ID:          34353563356132632D333634392D343065652D616261302D306132623436326632333466
Environment: Certificate

Public Key 1:
Label:       Release Signing Key
Key-Type:    RSA 2048
ID:          34353563356132632D333634392D343065652D616261302D306132623436326632333466
Environment: Certificate

Note the Label of the Signing Key you want to use. You will need this value in later steps.

If you see INFO: No objects available., review the troubleshooting guidance in Authenticate using a Built-in Account.

Create a sample file to sign​

In a temporary directory, create a file to use for the test:

echo "This is my test file" > signme.txt

You can use any file type, but a simple text file is sufficient for validation.

Sign the file​

Use the sign command to create a signature for the file.

You can either run the interactive wizard:

pkcs11config sign

or specify all options directly:

pkcs11config sign --filename signme.txt --label "<Signing Key Label>" --output signme.txt.sig

Replace <Signing Key Label> with the label you noted from the pkcs11config list output. For example:

pkcs11config sign --filename signme.txt --label "Release Signing Key" --output signme.txt.sig

If the operation succeeds, you should see a message similar to:

SUCCESS: Signed file 'signme.txt', signature written to 'signme.txt.sig'.

The native sign command hashes the file, signs the hash, and stores the raw signature. This format is intended to test key access only and is not compatible with most other tools. For production signing, integrate the client with your preferred signing application.

Verify the signature​

Use the verify command to confirm that the signature is valid:

pkcs11config verify --filename signme.txt --label "<Signing Key Label>" --input signme.txt.sig

If verification succeeds, you will see a confirmation message indicating that the signature is valid.

Troubleshooting​

"Label not found"​

This means the specified label does not match any Signing Key available to your authenticated Built-in Account.

  • Re-run pkcs11config list and copy the label exactly as shown.
  • Make sure you are authenticated with the correct Built-in Account.

Signature verification fails​

Check the following:

  • Ensure you are using the same file (signme.txt) and signature (signme.txt.sig) created during the signing step.
  • Confirm that the label used during verification matches the label used for signing.
  • Make sure the files were not modified between signing and verification.

What's next​

If the test signing and verification succeed, your environment is ready for integration.

Next steps: