Skip to main content

Documentation Index

Fetch the complete documentation index at: https://infisical.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

A Signer is a named code-signing identity bound to an X.509 certificate with the codeSigning extended key usage (EKU). Signers represent signing capabilities—for example, release-signer for production releases or ci-signer for CI pipeline artifacts.
Signers are created by product admins. Team members are assigned to Signers and can then request signing access or sign directly (depending on policy).
Private keys never leave the Infisical server. When a signing operation is requested, the server retrieves the key, computes the signature, and returns only the signature bytes.

​
Key Characteristics

FeatureDescription
Bound to certificateEvery signer must be linked to a certificate with the codeSigning EKU
Optional signing policyAttach a signing policy to require approval before signing
RSA and ECDSASupports RSA (2048, 3072, 4096-bit) and ECDSA (P-256, P-384, P-521)
Audit trailEvery signing operation is recorded with actor, algorithm, and grant information

​
Create a Signer

1

Issue a code-signing certificate

You need a certificate with the codeSigning extended key usage. Follow the certificate issuance guide and specify codeSigning in the extended key usage field.
Only certificates with the codeSigning EKU appear when creating a signer.
2

(Optional) Create a signing policy

To require approval before signing, create a Signing Policy first.Without a policy, any authorized user or identity can sign immediately.
3

Create the signer

Go to Certificate Manager → Code Signing → Signers and click Create Signer.Fill in the following fields:
  • Name: A slug-friendly name for the signer such as release-signer.
  • Description: An optional description of the signer’s purpose.
  • Certificate: The code-signing certificate to bind to this signer.
  • Signing Policy (optional): The signing policy that governs signing access for this signer. If omitted, signing is allowed without approval.
Press Create to save the signer.

​
Supported Signing Algorithms

The available signing algorithms depend on the certificate’s key type:

​
RSA

AlgorithmDescription
RSASSA_PKCS1_V1_5_SHA256RSA PKCS#1 v1.5 with SHA-256
RSASSA_PKCS1_V1_5_SHA384RSA PKCS#1 v1.5 with SHA-384
RSASSA_PKCS1_V1_5_SHA512RSA PKCS#1 v1.5 with SHA-512
RSASSA_PSS_SHA256RSA-PSS with SHA-256
RSASSA_PSS_SHA384RSA-PSS with SHA-384
RSASSA_PSS_SHA512RSA-PSS with SHA-512

​
ECDSA

AlgorithmDescription
ECDSA_SHA256ECDSA with SHA-256
ECDSA_SHA384ECDSA with SHA-384
ECDSA_SHA512ECDSA with SHA-512

​
Signing via API

You can also sign data programmatically by making an API request to the Sign endpoint: 
curl --request POST \
  --url https://app.infisical.com/api/v1/pki/signers/{signerId}/sign \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "data": "<base64-encoded-data>",
    "signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA256",
    "isDigest": true,
    "clientMetadata": {
      "tool": "custom-pipeline",
      "hostname": "build-server-1"
    }
  }'
  • The data field must be base64-encoded and no larger than 128 bytes (the digest of what you want to sign).
  • Set isDigest to true if the data is already a hash digest, or false if you want the server to hash it.
  • The clientMetadata field is optional and recorded in the signing operation audit log.

​
FAQ

Yes. Multiple signers can reference the same certificate, each with a different signing policy. This is useful if you want different approval workflows for different teams using the same signing key.
Signing requests will be rejected if the signer’s certificate has expired. You should issue a new certificate and update the signer’s certificate binding before expiry.
Yes, depending on the signing policy configuration. If the policy allows machine identity bypass, machine identities can sign without human intervention after obtaining a grant.

​
What’s Next?

Configure Signing Policies

Add approval workflows before signing operations.

PKCS#11 Module

Use standard signing tools with your signer.