DigiCert® Click-to-sign

DigiCert Click-to-sign is a DigiCert® KeyLocker client tool that provides Windows 10 or Windows 11 customers with a simple UI-based signing workflow that does not require use of the DigiCert® KeyLocker command line interface. After you specify your signing preferences in the DigiCert Click-to-sign installation wizard, you simply need to right-click on a file or folder to sign.

DigiCert Click-to-sign relies on Signing Manager Controller (SMCTL) and PKCS#11 library to sign.

注意

These client tools must be stored in the C:\Program Files\DigiCert\DigiCert KeyLocker Tools\ folder to be used by DigiCert Click-to-sign.

Prerequisites

Windows 10 or Windows 11 operating system
.NET Framework (version 4.7 or higher)
DigiCert Click-to-sign
Signing Manager Controller (SMCTL)
PKCS#11 library
DigiCert ONE API key
DigiCert ONE client authentication certificate
Integrated third-party signing tools
Keypair and associated certificate
File or folder to be signed

What signing tools can DigiCert Click-to-sign use?

DigiCert Click-to-sign supports the use of any signing tool supported by Signing Manager Controller (SMCTL) and PKCS#11 library, these include:

表 1. File types supported for signing on Windows

Signing tool	File type
Jarsigner	.ear
	.jar
	.sar
	.war
Mage	.application
	.manifest
	.vsto
NuGet	.nupkg
Signtool (64-bit)	.appx
	.appxbundle
	.arx
	.cab
	.cat
	.cbx
	.cpl
	.crx (only MS-DOS EXE package format)
	.dbx
	.deploy
	.dll
	.drx
	.efi
	.exe
	.js
	.msi
	.msix
	.msixbundle
	.msm
	.msp
	.ocx
	.psi
	.psm1
	.stl
	.sys
	.vbs
	.vsix
	.vxd
	.wsf
	.xap
	.xsn
SignTool (32-bit)	.doc
	.docm
	.dot
	.dotm
	.mpp
	.mpt
	.pot
	.potm
	.ppa
	.ppam
	.pps
	.ppsm
	.ppt
	.pptm
	.pub
	.vdw*
	.vdx*
	.vsd*
	.vsdm
	.vss*
	.vssm
	.vst*
	.vstm
	.vsx*
	.vtx*
	.wiz*
	.xla
	.xlam
	.xls
	.xlsb
	.xlsm
	.xlt
	.xltm

Download DigiCert Click-to-sign

Sign in to DigiCert ONE.
Navigate to the manager menu icon, select DigiCert® KeyLocker.
Select Resources > Client tool repository.
Download DigiCert Click-to-sign Installer.

Install DigiCert Click-to-sign

Run the DigiCert_Click_to_sign.msi application.
In the DigiCert Click-to-sign installation wizard, complete the following:

例 1. Credentials

DigiCert Click-to-sign client tool needs to integrate with DigiCert ONE REST APIs to validate you and stores your user credentials to expedite future signings.

Provide the DigiCert ONE host value: https://clientauth.one.digicert.com.
Enter your API key
Provide the path to your client authentication certificate
Enter your client authentication certificate password.
Check the box next to Save API key and client certificate password to Windows credential store to avoid having your credentials stored in the environment variables as plain text.

例 2. Certificate

DigiCert Click-to-sign requires you to choose a certificate to sign with. The default certificate of the keypair you select will automatically be selected.

To select the certificate to sign with:

Select a keypair from the list.
Verify that the default certificate information displayed on the right is correct.
Click Save.

例 3. Preferences

DigiCert Click-to-sign needs to store your signing preferences so that you simply need to right-click on a file or folder to sign it.

Select a digest algorithm to sign with.
注意
DigiCert recommends the use of SHA256 because it is the best practice to keep your signatures secure.
Leave this box checked if you want your signature to include a timestamp.
注意
DigiCert recommends the inclusion of a timestamp because it is a code signing best practice to extend the trust of signed software beyond the validity of the signing certificate.

Set PATH environment variable

Operating systems use the environment variable called PATH to determine where executable files are stored on your system. Use the PATH environment variable to store the file path to your DigiCert ONE Signing Manager Tools to ensure that the DigiCert® Click-to-sign can reference these tools.

You can set the PATH environment variable to DigiCert ONE Signing Manager Tools using command line or environment variables.

To set the path to your signing tools via command line:

set PATH=%path%;<Path to DigiCert ONE Signing Manager Tools folder>

Command sample:

set PATH=%path%;C:\Program Files\DigiCert\DigiCert One Signing Manager Tools

To set the path to your signing tools for your system or account:

Search for environment variables in the Windows start menu.
Select Edit environment variables for your account or Edit system environment variables.
Double click on the Path variable.
Click New.
Select Browse.
Provide the path to DigiCert ONE Signing Manager Tools: C:\Program Files\DigiCert\DigiCert One Signing Manager Tools
Click OK to save the path.
Click on OK to close the dialog.

本节内容如下:

DigiCert​​®​​ Click-to-sign

注意