Skip to main content
Code Signing is where teams digitally sign software, such as JARs, container images, Windows installers, Android APKs, Linux packages, and scripts. Teams sign through any tool that supports PKCS#11, with Windows signtool, or with the Sign API, and Infisical records every signing operation in an audit trail.

Signers

Create signing identities and choose who can sign with each one.

Approvals

Require approval before someone can sign, with limits on how many signatures and for how long.

Signing tools

Sign with jarsigner, apksigner, osslsigncode, cosign, OpenSSL, or GPG.

PKCS#11 module

Connect standard signing tools to your signers.

Windows KSP

Sign Windows executables, DLLs, and MSIs with signtool.
Each Signer represents a single signing identity, like mobile-app-prod, firmware-release, or ci-staging-builds. Product Admins create Signers, attach a code-signing certificate, and assign team members. Teams then operate independently within their assigned Signers.

​
What’s in a signer?

Certificate

The X.509 code-signing certificate the Signer uses, backed by an internal or external CA.

Members

Team members with Administrator, Operator, or Auditor roles on this Signer.

Approval policy

Optional review workflow before signatures are produced.

Activity

Audit trail of every successful, failed, and denied signing operation.

​
How a signing operation flows

  1. A Product Admin creates a Signer and picks the CA that issues its certificate.
  2. The Admin adds members (users, machine identities, or groups) and picks a role for each.
  3. Optionally, the Admin attaches an approval policy so signing requires sign-off.
  4. Operators sign through the PKCS#11 module, the Windows KSP (signtool), or the Sign API. Infisical produces the signature and records an audit entry on the Signer.

​
Signer roles

Members are assigned to Signers with one of three roles:

​
FAQ

When you distribute a key file, anyone with a copy can sign anything for the lifetime of the certificate, and you can’t take that copy back. With a Signer, you can disable signing, revoke active access, or remove a member at any time, and that change takes effect immediately.
No. A Signer can have no approval policy, in which case any member with sign rights can sign immediately and you still get a full audit trail. Approvals are optional and most useful for production releases or compliance-sensitive workloads.

​
What’s next?

Create a Signer

The 4-step wizard.

Add an approval policy

Require sign-off and cap per-approval limits.

Install the PKCS#11 module

Hook up your signing tools.

Sign your first JAR

End-to-end walkthrough.