A self-hosted remote code-signing daemon that wraps the sgcSign engine behind a REST API, a Bootstrap web admin console, and a command line client for CI/CD pipelines.
A single host, Windows or Linux, accepts signing requests from build agents, developers, and CI pipelines — with full audit, approvals, and metrics built in.
TLS-secured /api/v1 endpoints for signing, verification, health, metrics, and approval workflows. Stable, machine-friendly contract for build agents and SDKs.
Bootstrap-based /admin UI for users, API keys, providers, projects, audit, approvals, webhooks, and metrics. Operators never need to edit JSON.
Inno Setup wizard or zip-drop. The daemon registers itself as a Windows service, terminates TLS itself, and runs unattended on a hardened host.
Each project isolates a subset of providers, API keys, audit visibility, and approval queues. Several teams share one server without seeing each other's signing material.
The same API key requests, an admin or project admin approves or rejects, and only then are the bytes signed. SHA-256 hash and file size are locked into the request.
Every action — sign, verify, login, approval, webhook fire — is appended to a hash-chained audit log. Tampering is detectable; SIEM scraping is straightforward.
Sign / verify / approval counters, signing-latency histograms, provider-availability gauges. Direct Prometheus 0.0.4 text exposition with no extra database to manage.
21 lifecycle events delivered with X-Sgcsign-Signature: sha256=…. Three-attempt retry queue keeps SIEM, chat, and ticketing systems in sync.
The same engine that ships in the library, exposed through the REST API. Every country profile, every signature level.
XML signatures for VeriFactu, FatturaPA, Facturae, KSeF, e-Factura, Peppol, myDATA and EU employment contracts. POST /api/v1/sign/xades.
PAdES-Basic PDF signatures with incremental updates that preserve original content. Visible or invisible signatures. POST /api/v1/sign/pades.
CMS / PKCS#7 detached or attached signatures for arbitrary binary data. Timestamp + long-term validation. POST /api/v1/sign/cades.
Builds and signs a registered sale with a key the server holds, optionally posts it to the tax authority and returns the answer. A chain of tills shares one taxpayer certificate. POST /api/v1/sign/eet.
The signing daemon talks to whichever cert source you configure: Windows store, PFX, PKCS#11 hardware token, Azure Trusted Signing, AWS KMS, Google KMS.
Sign .exe, .dll, .msi, .cab, .cat, .ocx, .sys. Hash-only mode lets low-bandwidth runners exchange a few dozen bytes for an 8 KB PKCS#7 blob. Add --page-hashes (page_hashes in the API) for page hashes on kernel-mode drivers, like signtool /ph.
Sign ClickOnce manifests (.application / .manifest) so Windows clients install without trust prompts. POST /api/v1/sign/clickonce.
Sign .nupkg packages so the NuGet client validates publisher identity. Author and repository signatures supported. POST /api/v1/sign/nuget.
Sign Visual Studio extension packages so VS Marketplace and the IDE itself accept them as trusted. POST /api/v1/sign/vsix.
Stronger sign-in for the admin console and encrypted secrets on disk, so a stolen password or a copied configuration file does not open the signing keys.
Console accounts add a 6 digit code from any TOTP authenticator app, with 10 single-use recovery codes for a lost phone. Set admin.require_2fa and every console user must enroll before reaching any other page. An administrator can reset a lost second factor.
Sign in to the console with Microsoft Entra ID, Okta, Keycloak, Google or any standard OpenID Connect provider, using the authorization code flow with PKCE. Users link an external identity to their account, and new users can optionally request an account that an administrator approves.
Every response carries security headers and a strict Content Security Policy. A configurable password policy, temporary passwords that must be replaced at the first sign-in, and sessions that end as soon as the role or rights behind them change.
Provider passwords, PINs, cloud credentials and webhook secrets are stored encrypted with AES-256-GCM under a master key bound to the machine (DPAPI on Windows). sgcSignServer --protect-secrets encrypts an existing configuration in place.
The server decides who may sign, with which key and after whose approval, and every signature gets a timestamp even when one timestamp server is down.
Mark a provider or a whole project as approval required, and the server refuses direct signing with approval_required. Each approval signs once. The rule holds on every signing path, raw digest signing for signtool /dlib included.
Regenerate a key while the old secret keeps working for up to 7 days, edit its expiry, see who owns it and limit it to a list of allowed providers. With api_keys.self_service, operators create and manage their own keys within the limits you set. A key can also start its validity at first use: it is valid for N days counted from its first authenticated call, with a required activate-before date so an unused key never stays valid forever. Sub-keys work only once their parent key is activated, activation is recorded in the audit log as apikey.activate, and Community caps both values at 30 days.
The server counts incorrect PIN results per token and stops logging in after max_pin_attempts, so a wrong PIN in the configuration never locks a hardware token. The final try is used only with allow_final_pin_try, and an administrator resets the guard from the console.
sgcsign config saves the server, provider and other settings in named profiles, and sgcsign auth set-key stores the API key, so build scripts stop repeating them. The Delphi CLI and the .NET tool esegece.sgcsign.cli share the same files.
tsa_urls lists, and no_timestamp for a request that must not be timestamped.
sgcsign timestamp adds a timestamp to a file that is already Authenticode signed, with the same fallback.
# sgcSignServer.conf.json
"timestamp": {
"servers": ["http://timestamp.digicert.com", "http://timestamp.sectigo.com"],
"timeout_ms": 30000
}
# Timestamp a file that is already signed
sgcsign timestamp MyApp.exe --tsa http://timestamp.digicert.com --tsa http://timestamp.sectigo.comRun the server for years without surprises: encrypted backups, warnings before a certificate expires, email when something needs a person, and a Windows installer.
One archive holds the configuration, the database, the master key and every key and certificate file, encrypted with AES-256-GCM under a passphrase. Archives run on a schedule or from the console, and sgcSignServer --archive restore rebuilds the server on the same machine or moves it to a new one.
The signing certificates and the TLS certificate of the server are checked at start and every day. Warnings at 30, 14, 7 and 1 days left show on the dashboard and go out as the cert.expiring webhook, an email and the sgcsign_certificate_not_after_seconds metric.
Email when an account is locked out, when two-factor authentication or a password changes, when a backup fails or a certificate is about to expire. SMTP with STARTTLS or implicit TLS, and on Windows the mailer needs no OpenSSL libraries.
sgcSignServer_Setup.exe installs the server as a Windows service, creates the first administrator and opens the firewall port. TLS uses a generated self-signed certificate, an existing PFX file, or plain HTTP for test machines.
A single Windows service terminates TLS, exposes /api/v1 + /admin, and reaches out to the configured key provider on every call. Key material never lives in the database.
/api/v1 over HTTPS with a bearer API key.
/admin in any browser. Bootstrap UI, session cookies, role-based access.
+----------------------------+
| Build agents / CI / CLI |
+-------------+--------------+
|
| HTTPS (TLS 1.2/1.3)
v
+-------------------------------------------+
| sgcSignServer.exe (Windows service) |
| /api/v1/* (signing, verify, health) |
| /admin/* (web console, sessions) |
+---+-----------------+---------------------+
| | |
v v v
+-------------+ +---------------+ +-----------+
| SQLite DB | | KeyProviders | | Webhooks |
| (audit/keys)| | PFX/HSM/KMS | | (outbound)|
+-------------+ +---------------+ +-----------+curl AwayA bearer API key, a hash or file upload, and the signed binary streams back to stdout. Authenticode, CAdES, PAdES, XAdES, ClickOnce, NuGet, VSIX share the same shape.
X-API-Key or Authorization: Bearer — either auth method works.
X-Project selects the tenant; the key must be authorised for the project.
X-Sgcsign-Signer-Subject + X-Sgcsign-Duration-Ms for log correlation.
# Authenticode-sign MyApp.exe via the REST API
curl -X POST https://sign.example.com/api/v1/sign \
-H "Authorization: Bearer $TOKEN" \
-H "X-Project: production" \
-F "format=authenticode" \
-F "file=@./MyApp.exe" \
-o MyApp-signed.exe
# Headers returned by the server
# X-Sgcsign-Signer-Subject: CN=ACME Corp, O=ACME, C=US
# X-Sgcsign-Duration-Ms: 312From a fresh Windows host to the first signed artefact in under five minutes.
Run the bundled Inno Setup wizard or drop the zip into a folder. The daemon registers itself as a Windows service called sgcSignServer. Bind to :8443 and load your TLS certificate.
Add a provider to sgcSignServer.conf.json — a PFX file, Azure Trusted Signing account, AWS KMS key, Certum SimplySign user, or any of the other ten key providers. No service restart required.
Open /admin/apikeys, click New API key, scope it to a project, copy the token into your CI runner secret. Build agent calls POST /api/v1/sign.