Windows clients installer (recommended)

We recommend this approach of installing the DigiCert® KeyLocker client tools on Windows.

Easily deploy and configure all the tools and libraries you may require for signing both Microsoft and non-Microsoft files on Window using a wizard supported installation experience.

What clients are included in the installer?

The following clients will be installed:

Signing Manager CTL (SMCTL)
SMCTL provides a Command Line Interface (CLI) that facilitates manual or automated private key, certificate management, and signing with or without the need for human intervention.
DigiCert® Click-to-sign
DigiCert Click-to-sign provides Windows customers with a simple UI-based signing workflow that does not require use of the SMCTL. After you specify your signing preferences in the DigiCert Click-to-sign installation wizard, you simply need to right-click on a file or folder to sign.
PKCS11 library
The PKCS11 library handles secure key generation, application hash signing, and associated certificate-related requirements when the signing request does not require the transportation of files and intellectual property.
KSP is a Microsoft CNG (Cryptographic: Next Generation) library-based client-side tool
JCE library
The JCE library is used for signing with Jarsigner and integrates with any operating system that supports Java.

Download Windows clients installer

Sign in to DigiCert ONE.
Navigate to > Resources > Client tool repository.
Select Windows as your operating system.
Click the download icon next to clients installer.

Installation

Run Keylockertools-windows-x64.msi.
Follow the wizard to install the tools on your system.

Configure SMCTL

Select one of the four methods below to configure your environment variables for SMCTL. The most secure method is to store your API key and Client authentication certificate password in Windows Credential Manager.

Install DigiCert Click-to-sign

Run the DigiCert_Click_to_sign.msi application.
In the DigiCert Click-to-sign installation wizard, complete the following:

ejemplo 1. Credentials

DigiCert Click-to-sign client tool needs to integrate with DigiCert ONE REST APIs to validate you and stores your user credentials to expedite future signings.

Provide the DigiCert ONE host value: https://clientauth.one.digicert.com.
Enter your API key
Provide the path to your client authentication certificate
Enter your client authentication certificate password.
Check the box next to Save API key and client certificate password to Windows credential store to avoid having your credentials stored in the environment variables as plain text.

ejemplo 2. Certificate

DigiCert Click-to-sign requires you to choose a certificate to sign with. The default certificate of the keypair you select will automatically be selected.

To select the certificate to sign with:

Select a keypair from the list.
Verify that the default certificate information displayed on the right is correct.
Click Save.

ejemplo 3. Preferences

DigiCert Click-to-sign needs to store your signing preferences so that you simply need to right-click on a file or folder to sign it.

Select a digest algorithm to sign with.
Nota
DigiCert recommends the use of SHA256 because it is the best practice to keep your signatures secure.
Leave this box checked if you want your signature to include a timestamp.
Nota
DigiCert recommends the inclusion of a timestamp because it is a code signing best practice to extend the trust of signed software beyond the validity of the signing certificate.

En esta sección: