enterprise

The signer has the fully qualified class name: org.signserver.module.msauthcode.signer.MSAuthCodeSigner.

Overview

The MS Authenticode signer signs portable executable files such as Windows executables and shared libraries (.exe, .dll and .ocx etc) according to the Windows Authenticode Portable Executable Signature Format, and also Windows installer packages (.msi), PowerShell scripts (.ps1, .psm1 and .psd1), Windows Catalog Files (.cat), and Cabinet archives (.cab). The signature can optionally include a timestamp response from a TSA using the RFC#3161, or legacy Authenticode format. For more information, see Time Stamp Signer.

MSI files larger than 2 GB are currently not supported.

Available Properties

Property

Description

ALLOW_ENCODING_OVERRIDE

(Optional) Specifies if the requestor can override the encoding by supplying it as a request metadata property. Default: False.

ALLOW_PROGRAM_NAME_OVERRIDE 

(Optional) Specifies if the requestor can override the program name by supplying it as a request metadata property. Default: False.

ALLOW_PROGRAM_URL_OVERRIDE

(Optional) Specifies if the requestor can override the program URL by supplying it as a request metadata property. Default: False.

DIGESTALGORITHM 

(Optional) Algorithm for the digest of the binary. Default: SHA256.

DO_LOGRESPONSE_DIGEST 

(Optional) If a digest of the response should be computed and logged. Default: True.

DO_LOGREQUEST_DIGEST 

(Optional) If a digest of the request should be computed and logged. Default: True.

ENCODING

(Optional) Sets the character encoding when signing PowerShell scripts (.ps1). Default: utf-8.

LOGRESPONSE_DIGESTALGORITHM 

Algorithm used to create the message digest (hash) of the response document to put in the log. Default: SHA256.

LOGREQUEST_DIGESTALGORITHM 

Algorithm used to create the message digest (hash) of the request document to put in the log. Default: SHA256.

KEEPSIGNATURES

(Optional) True if existing signature should be kept. Default: True.

Property only available when signing PE and PS1 file types.

PROGRAM_NAME

(Optional) Specifies the program name to embed in the signature. Default: none.

PROGRAM_URL 

(Optional) Specifies the program URL to embed in the signature. Default: none.

SIGNATUREALGORITHM 

(Optional) Signature algorithm. The default depends on the signing key:

  • SHA256withRSA

  • SHA256withDSA

  • SHA256withECDSA

TIMESTAMP_FORMAT 

Specifies the timestamp format to use. Allowed values:

  • RFC3161 (Default)

  • AUTHENTICODE

If the value AUTHENTICODE is set, a legacy Authenticode timestamp signer is assumed, rather than a standard RFC3161-compliant one.

TSA_PASSWORD 

Login password used if the TSA uses HTTP Basic Auth. Required if TSA_USERNAME is specified.

Default: none.

TSA_URL 

(Optional) Specifies the URL of external (Authenticode or RFC#3161) time-stamp authority.

Default: none.

TSA_URL cannot be combined with TSA_WORKER.

TSA_USERNAME 

(Optional) Specifies the login username used if the TSA uses HTTP Basic Auth.

Default: none.

TSA_WORKER 

(Optional) Worker ID or name of internal (Authenticode or RFC#3161) time-stamp signer in the same SignServer.

Default: none.

TSA_WORKER cannot be combined with TSA_URL.

Request Properties

This worker can accept the following request metadata properties, given that they are configured to be allowed:

Property

Description

ENCODING

Overrides the encoding when signing PowerShell scripts (.ps1). Without ALLOW_ENCODING_OVERRIDE configured in the worker request, including this request property will not be allowed.

FILE_TYPE

Option to specify that the supplied file is using a specific file type. Normally, this is optional and the PE, MSI, and CAT file types are detected based on the content of the files and PS1 files are detected based on the file extension of the provided file name (if one). In order to support PowerShell scripts even if the file name is not provided or the extension is not one of .ps1, .psm1 or .psd1, the FILE_TYPE request property can be explicitly set in the request.
Supported values:

  • PE

  • MSI

  • PS1

  • CAT

PROGRAM_NAME 

Program name text to use instead of the configured one (if any). Specifying an empty value removes the configured program name. Without ALLOW_PROGRAM_NAME_OVERRIDE configured in the worker request, including this request property will not be allowed.

PROGRAM_URL 

Program URL to use instead of the configured one (if any). Specifying an empty value removes the configured program URL. Without ALLOW_PROGRAM_URL_OVERRIDE configured in the worker request, including this request property will not be allowed.

Worker Log Fields

Field

Description

FILE_TYPE

The type of file that was detected or requested to be signed.

REQUEST_DIGEST 

A message digest (hash) for the request document in hex encoding.

REQUEST_DIGEST_ALGORITHM

The name of the message digest (hash) algorithm used for the request digest in the log.

RESPONSE_DIGEST

A message digest (hash) for the response document in hex encoding.

RESPONSE_DIGEST_ALGORITHM

The name of the message digest (hash) algorithm used for the response digest in the log.