Code signing is what turns “an executable I downloaded” into “an executable I can trust.” TigerTrust centralizes the code-signing lifecycle: issue the certificate, protect the key (software or HSM), run the signing operation, record the signature, and verify on demand — all audited and gated by role controls.
Code Signing

​
What it is

Code-signing certificates in TigerTrust have their own lifecycle separate from server TLS certificates. Each one carries a platform (windows, java, macos, linux, powershell, nuget, pypi, docker) so the signing operation knows which format to emit. You sign files via the product UI or API, and TigerTrust handles the platform-specific envelope format.

​
When to use it

  • Sign Windows installers and executables with Authenticode so Defender and SmartScreen accept them.
  • Sign Java JARs for distribution through enterprise app stores.
  • Gate signing operations behind a two-person approval for production releases.
  • Sign with an HSM-resident key that never leaves the hardware.

​
Set it up

1

Issue a code-signing certificate

Go to Code Signing > Certificates and click New certificate. Choose a platform, enter the subject, select a CA, and set validity. For HSM-backed keys, use the HSM tab to generate the key directly in the hardware module.
2

Sign a file

Go to Code Signing > Sign. Upload the file (up to 50 MB) or paste a pre-computed hash. Select the certificate and, if required, enter a timestamp server URL for long-term signature validity. Click Sign.
3

Configure an approval workflow (optional)

Go to Code Signing > Requests to see pending signing requests. Configure an approval policy so that signing with production certificates requires a designated release engineer’s approval before the signature is applied.
4

Verify a signature

Go to Code Signing > Verify, upload the signed artifact (or provide the operation ID from a previous signing), and click Verify. TigerTrust checks signature integrity, certificate validity, trust chain, and timestamp validity.

​
What you’ll see

Code Signing > Operations lists every signing attempt with certificate, filename, hash, status, and the user who initiated the operation. Signed artifacts stored by TigerTrust are available for download. The verification result shows signatureValid, certificateValid, trustChainValid, and (when applicable) timestampValid.

​
Platform-specific output formats

Authenticode (Windows)

PKCS#7 SignedData embedded into the PE/MSI/CAB structure. Supports RFC 3161 timestamps so signatures remain valid after the certificate expires.

Jar signing (Java)

Signs the JAR manifest and each entry, producing standard META-INF signature files. Works for JAR, WAR, EAR, and APK.

codesign (macOS)

Detached Mach-O signature suitable for stapling to notarized bundles — APP, DMG, and PKG.

Detached PGP

ASCII-armored detached signature for DEB, RPM, Python wheels, and generic tarballs.

​
HSM-backed signing

For certificates whose private key lives in an HSM (YubiHSM, Thales Luna, nCipher, AWS CloudHSM, SoftHSM), use the HSM signing flow. Select the HSM slot and certificate, and TigerTrust routes the signing operation through the PKCS#11 interface — the key never leaves the hardware.
The maximum file size for direct upload is 50 MB. For larger artifacts, compute the hash externally, upload the artifact to your own storage, and submit only the hash to TigerTrust for signing.

Document signing

PDF/PAdES and CAdES signatures with the same certificate flow.

Approvals

Gate signing operations behind two-person or workflow-based approvals.

PKI Core

The internal CA that issues the code-signing certificates.