Sign Windows Executables with osslsigncode

This guide assumes your Product Admin has already created a Signer and assigned you to it. If the signer has an approval policy, you’ll also need active access before signing.

Sign Windows Authenticode artifacts using osslsigncode with the Infisical PKCS#11 module. osslsigncode is a cross-platform tool that lets you sign Windows binaries from Linux and macOS, making it ideal for CI/CD pipelines that don’t run on Windows.

Prerequisites

A Signer created by your Product Admin
Active signing access (if an approval policy is attached)
A machine identity added to the Signer
The Infisical PKCS#11 module installed and configured
osslsigncode 2.5 or later (includes native PKCS#11 support)

Step 1: Set Up Authentication

Configure the Infisical PKCS#11 module with your machine identity credentials. Without this, the signing commands below fail with an auth error. Create /etc/infisical/pkcs11.conf (or set INFISICAL_CONFIG to point elsewhere):

auth:
  method: universal-auth
  universal_auth:
    client_id: "<machine-identity-client-id>"
    client_secret: "<machine-identity-client-secret>"

signer:
  id: "<signer-id>"

You can also pass the credentials via environment variables:

export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="<machine-identity-client-id>"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="<machine-identity-client-secret>"

Environment variables override values from the config file.

For the full set of options, see the PKCS#11 module configuration reference.

Step 2: Install osslsigncode and Dependencies

Ubuntu / Debian
macOS (Homebrew)
Build from source

sudo apt-get update
sudo apt-get install -y osslsigncode opensc

brew install osslsigncode opensc

git clone https://github.com/mtrojnar/osslsigncode.git
cd osslsigncode
mkdir build && cd build
cmake ..
make
sudo make install

Step 3: Identify Your Signer

Use pkcs11-tool to list available signers and note the token label:

pkcs11-tool --module /usr/local/lib/libinfisical-pkcs11.so --list-slots

Available slots:
Slot 0 (0x0): release-signer
  token label        : release-signer
  token manufacturer : Infisical

Step 4: Sign a Windows Executable

Use osslsigncode with the PKCS#11 module to sign your binary:

osslsigncode sign \
  -pkcs11module /usr/local/lib/libinfisical-pkcs11.so \
  -pkcs11cert "pkcs11:object=release-signer;type=cert" \
  -key "pkcs11:object=release-signer;type=private" \
  -h sha256 \
  -n "My Application" \
  -i "https://example.com" \
  -t http://timestamp.digicert.com \
  -in MyApp.exe \
  -out MyApp-signed.exe

-pkcs11module: Path to the Infisical PKCS#11 shared library.
-pkcs11cert and -key: PKCS#11 URI referencing your signer by name. Replace release-signer with your signer name.
-h sha256: Hash algorithm for the signature digest.
-n: Description embedded in the signature (shown in Windows UAC prompts).
-i: URL for more information about the publisher.
-t: Timestamp server URL. Timestamping ensures the signature remains valid after your certificate expires.

Supported File Types

osslsigncode can sign the following Windows artifact types:

Type	Extensions
Executables	`.exe`, `.dll`, `.sys`, `.ocx`
Installers	`.msi`, `.msix`, `.appx`
Cabinet files	`.cab`
Scripts	`.ps1`, `.vbs`
Catalogs	`.cat`

Step 5: Verify the Signature

Verify the signed binary:

osslsigncode verify MyApp-signed.exe

The output confirms the signature is valid:

Signature verification: ok

CI/CD Integration

export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="${INFISICAL_CLIENT_ID}"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="${INFISICAL_CLIENT_SECRET}"
export INFISICAL_CONFIG="/path/to/pkcs11.conf"

osslsigncode sign \
  -pkcs11module /usr/local/lib/libinfisical-pkcs11.so \
  -pkcs11cert "pkcs11:object=release-signer;type=cert" \
  -key "pkcs11:object=release-signer;type=private" \
  -h sha256 \
  -n "My Application" \
  -t http://timestamp.digicert.com \
  -in MyApp.exe \
  -out MyApp-signed.exe

Troubleshooting

For any issue, enable debug logging in your config file ("log_level": "debug", "log_file": "/tmp/infisical-pkcs11.log") to get detailed output.

Key not found or signing errors

Verify the object name in the PKCS#11 URI matches your signer name exactly and that you have active signing access. You can list available signers with pkcs11-tool --module /path/to/lib --list-slots.

Certificate not found in PKCS#11

The -pkcs11cert URI must match your signer name exactly. Use pkcs11-tool --module /path/to/lib --list-objects --type cert to verify available certificate labels.

Certificate Management

Product Reference

Reference

Sign Windows Executables with osslsigncode

Prerequisites

Step 1: Set Up Authentication

Step 2: Install osslsigncode and Dependencies

Step 3: Identify Your Signer

Step 4: Sign a Windows Executable

Supported File Types

Step 5: Verify the Signature

CI/CD Integration

Troubleshooting

What’s Next?

Sign with OpenSSL

Sign Android APKs

​Prerequisites

​Step 1: Set Up Authentication

​Step 2: Install osslsigncode and Dependencies

​Step 3: Identify Your Signer

​Step 4: Sign a Windows Executable

​Supported File Types

​Step 5: Verify the Signature

​CI/CD Integration

​Troubleshooting

​What’s Next?

Sign with OpenSSL

Sign Android APKs

Prerequisites

Step 1: Set Up Authentication

Step 2: Install osslsigncode and Dependencies

Step 3: Identify Your Signer

Step 4: Sign a Windows Executable

Supported File Types

Step 5: Verify the Signature

CI/CD Integration

Troubleshooting

What’s Next?