DigiCert KeyLocker

We resolved an issue where signing applications contained OpenSSL vulnerabilities.

With this release, the latest Click-to-Sign includes updated libraries with no known vulnerabilities.

Code signing using DigiCert® Software Trust Manager with GitHub Actions is a streamlined, keypair-based signing workflow that improves software security and seamlessly integrates with DevOps processes to sign binaries on Windows, Linux, and Mac.

This action delivers a dramatically improved code signing experience, richer automation, and broader platform support.

Review the following features of this action:

To learn more, see Code signing with DigiCert Software Trust Manager in GitHub.

In a previous release, we had a limited launch of a new guided wizard experience that helps users to get started with KeyLocker and start signing quickly.

With this release, this wizard experience is available to all users, without the need to contact your Account Manager.

To access the KeyLocker wizard:

We resolved an issue where signature-usage alert emails (80%, 90%, and 100% thresholds) weren't being sent.

With this release, all signature-consumption thresholds trigger the correct email notifications.

We resolved an issue where the SMCTL healthcheck command wouldn’t add an entry to the database when signing tools weren't present. (For macOS, signing tools were never returned even when available.)

With this release, the SMCTL healthcheck command now correctly logs database entries across all OSes, even when signing tools are absent.

We have introduced a guided wizard experience for getting started with KeyLocker to start signing quickly.

To learn more, see Signer guide.

In DigiCert ONE, the Start signing with DigiCert KeyLocker guide has been updated to clearly indicate support for macOS as an option when setting up credentials and client tools. While macOS was previously supported, it wasn't listed in the corresponding dropdown as an obvious selection.

The DigiCert ONE Clients now supports DigiCert KeyLocker. This mean DigiCert KeyLocker, in addition to Software Trust Manager and Trust Lifecycle Manager users can use the app to download, automate configuration, and keep their client tools up-to-date.

We resolved an issue where users received a Error parsing JSON object error when attempting to change the signer to themselves. Users can now successfully update the signer without encountering this error.

On September 12, 2025, at 10:00 MDT (16:00 UTC), DigiCert will add new IP addresses for inbound requests using the Client authentication endpoint (clientauth.one.digicert.com).

To ensure proper connectivity for your client tools, you or your customers need to add the following IP addresses to applicable allowlists and firewall rules:

We updated two broken links that were displaying in the Start signing with DigiCert KeyLocker setup wizard. This update ensures the correct workflow to access DigiCert's documentation site.

In the DigiCert KeyLocker section of DigiCert ONE, we have made significant style updates to the platform to improve the user experience, including:

We will continue making additional design and styles changes in future releases.

We have added two flags that allow users to sign without the need of third-party tools or libraries:

--simple

--unsigned

To learn more, see Sign binary commands.

DigiCert must perform maintenance affecting DigiCert® Software Trust Manager, DigiCert® Document Trust Manager, and the PrimoSign signing service in our DigiCert® ONE USA location during scheduled maintenance on July 12, 2025, 22:00 – 24:00 MDT (July 13, 04:00 – 06:00 UTC). For more details, refer to the DigiCert Global 2025 maintenance schedule.

During this time, the Software Trust Manager and Document Trust Manager will be down for approximately 10 minutes, and the PrimoSign signing service will be down for approximately 30 minutes.

Services will be restored as soon as we complete our maintenance.

How does this affect me?

Affected services

What can I do?

Plan accordingly:

We apologize for any inconvenience. If you have questions or concerns, please contact your account manager or PKI Support | DigiCert.

We have added new flags for SMCTL that allow users to define the application name in User Account Control (UAC) prompts.

This enhancement also enforces UTF-8 encoding to prevent character display issues, particularly on systems using Japanese language settings.

We have added the following flags:

We resolved an issue where the smksp_cert_sync.exe process was failing during execution.

We resolved an issue affecting PKCS#11 client tool commands, specifically the following commands: p11cat, p11ls, p11more, and p11od.

We resolved an issue where non-subscription KeyLocker orders were incorrectly displaying Invalid date in the Current subscription term field under Signature limit in DigiCert ONE.

This issue has been resolved; the field now only displays for retail subscription orders.

We have introduced new renewal workflows for retail subscriptions in KeyLocker. With this release, when your subscription is renewed in CertCentral, KeyLocker will automatically update your order with the new subscription dates and allotted signatures.

Additionally with this release, email notifications are generated to KeyLocker account admins and assigned users regarding the new subscription period.

We have resolved an issue that prevented users from signing .jar files using the JCE method with Java 8.

Previously, attempts to sign using the documented jarsigner command failed, despite JCE method support for Java 8.

With this update, we have ensured compatibility of the JCE signing method with Java 8.

Notes::

To address user feedback, we have upgraded client tools and software. This update does not impact KeyLocker customers, and no user action is required.

To keep users informed about KeyLocker signature consumption, in this release we have introduced email notifications.

When 80%, 90%, and 100% of signature units are used, an email will be sent to the assigned signer and all account admins, when applicable.

With this release:

To address user feedback, we have upgraded client tools and software. This update does not impact KeyLocker customers, and no user action is required.

To address user feedback, we have upgraded client tools and software. This update does not impact KeyLocker customers, and no user action is required.

We resolved a broken documentation link in the Get started page in DigiCert One.