How to use this guide:
Errors are grouped by signing method or tool. The Interface column tells you where the customer will have seen the message — a command-line (CLI) window, an app/GUI popup, a log file, a CI/CD pipeline console, or a general Windows system message — so you can quickly confirm you’re looking at the right entry. Quoted text in the Error/Symptom column is the literal message where SSL.com’s documentation gives it verbatim. For issues that require changes on SSL.com’s backend, the Resolution column says so directly — in those cases, the customer’s own next step is to contact SSL.com Support, who will escalate to engineering as needed.
Errors are grouped by signing method or tool. The Interface column tells you where the customer will have seen the message — a command-line (CLI) window, an app/GUI popup, a log file, a CI/CD pipeline console, or a general Windows system message — so you can quickly confirm you’re looking at the right entry. Quoted text in the Error/Symptom column is the literal message where SSL.com’s documentation gives it verbatim. For issues that require changes on SSL.com’s backend, the Resolution column says so directly — in those cases, the customer’s own next step is to contact SSL.com Support, who will escalate to engineering as needed.
Token-Based Code Signing — General /SignTool
Applies to any hardware-token workflow (YubiKey or SafeNet) using Microsoft SignTool| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| “’Signtool’ Is Not Recognized as an Internal or External Command, Operable Program or Batch File” | CLI | The command was typed with the bare word “signtool” instead of the full path to signtool.exe. | Replace “signtool” in the command with the full path to signtool.exe (e.g. C:\Program Files (x86)\Windows Kits\10\bin\<SDK VERSION>\x64\signtool.exe). | Using Your Code Signing Certificate |
| “The timestamp certificate does not meet a minimum public key length requirement” | CLI | SSL.com’s default timestamp server issues ECDSA-based timestamps, and the signing software/vendor does not accept ECDSA timestamp keys. | Ask your software vendor to permit ECDSA timestamp keys, or use the legacy RSA timestamp endpoint http://ts.ssl.com/legacy. | Using Your Code Signing Certificate |
| “Windows can’t verify the publisher of this driver software” | Windows System | The software or driver was distributed without a valid code signing certificate applied, so Windows cannot confirm the publisher’s identity. | Sign the software with a valid OV or EV code signing certificate before distribution. | eSigner: Code Signing as a Service |
| Configuration issues after installing an OV/EV certificate | Windows System | OV and EV code signing certificates were installed manually into the computer’s certificate store instead of being used from the hardware token/HSM. | Do not manually install OV/EV code signing certificates; use them directly from the YubiKey FIPS token, SafeNet token, or via eSigner cloud signing. | Using Your Code Signing Certificate |
YubiKey FIPS Token Errors
Applies to code signing certificates issued on a YubiKey FIPS 140-2 hardware token.| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| Don’t know / can’t find YubiKey PIN or PUK | N/A | PIN/PUK were never retrieved from the account portal, or the token was reissued. | Log in to the SSL.com customer portal, open the certificate order, and use the “activate” link under Physical Tokens / YubiKey FIPS 140-2 to retrieve the PIN and PUK. | Access Your YubiKey FIPS PIN and PUK |
| YubiKey not detected by the computer / certificate not found by SignTool | Windows System | Yubico Authenticator or the required mini-driver is not installed, so the OS cannot see the certificate on the token. | Install Yubico Authenticator and the YubiKey mini-driver; confirm the token’s serial number appears in Yubico Authenticator before signing. | Using Your Code Signing Certificate |
Thales SafeNet (Gemalto) Token Errors
Applies to code signing certificates issued on a Thales SafeNet/Gemalto USB token, used with SafeNet Authentication Client (SAC).| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| “Incorrect password” | App/GUI | The wrong token password/PIN was entered while signing with SignTool. | Re-enter the correct token password; if forgotten, retrieve it from your SSL.com account order details or reset it using your PUK. | How to Change your Thales SafeNet/Gemalto Token Password |
| “The token is locked as a result of too many failed logon attempts” | App/GUI | The maximum number of allowed incorrect password/PIN attempts was exceeded. | Open SafeNet Authentication Client, use the Advanced view, select Set Token Password, enter your PUK as the Administrator Password, then set and confirm a new token password. | How to Change your Thales SafeNet/Gemalto Token Password |
| “’Signtool’ Is Not Recognized as an Internal or External Command, Operable Program or Batch File” | CLI | Same SignTool path issue as the general token section — command entered without the full executable path. | Replace “signtool” with the full path to signtool.exe in the command. | Using Your Code Signing Certificate |
| SafeNet Authentication Client not detecting the token after install | Windows System | SAC was installed but the computer was not restarted, so driver/service changes have not taken effect. | Restart the computer after installing SafeNet Authentication Client; the token should then be recognized. | SafeNet Authentication Client Download for Code Signing Certificates |
eSigner CodeSignTool (CLI)
Applies to SSL.com’s CodeSignTool Java CLI utility.| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| Can’t find the eSigner Credential ID | App/GUI | Credential ID (required for CodeSignTool and the CSC API) hasn’t been located in the account portal. | In the SSL.com account, open the certificate order and scroll to the Signing Credentials section to view the eSigner credential ID, certificate serial, and eSigner label. | eSigner Signing Credential Guide |
| “Error: invalid otp” (manual signing) | App/GUI | The QR code scanned into the authenticator app doesn’t match the username/password/credential ID used, or the OTP has expired. | Confirm you scanned the correct account’s QR code (not a teammate’s shared one), re-generate a fresh OTP, and re-enter it promptly since OTPs expire quickly. | eSigner CodeSignTool Command Guide |
| “Error: invalid otp” (automated / TOTP signing) | CLI | The TOTP secret belongs to a different account/certificate than the username, password, and credential ID specified; the secret itself is invalid; or system time is unsynchronized. | Verify the TOTP secret matches the account and credential ID in use, confirm the secret was copied correctly, and sync your system clock with a reliable time server (TOTP depends on close time alignment with the signing server). | Automate eSigner EV Code Signing |
| “’C:\Users\Admin\Dropbox\My’ is not recognized as an internal or external command, operable program or batch file.” / “The system cannot find the path specified.” | CLI | A file path containing spaces was passed to CodeSignTool without quotation marks, so the shell parsed it as multiple separate arguments. | Enclose input file path and output directory path in quotation marks, and type or copy-paste parameters directly into the command line rather than through another text editor. | Code Signing NuGet Packages with eSigner |
| “\Documents\sample was unexpected at this time.” | CLI | Continuation of the same unquoted-path parsing failure — the shell breaks the path at the space and treats the remainder as a stray token. | Wrap the full file path in quotation marks so the shell treats it as a single argument. | Code Signing NuGet Packages with eSigner |
| “WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.” | CLI | A benign Java runtime warning triggered by the JVM version used to run CodeSignTool. | This is a performance warning, not a signing failure — it can be disregarded; verify the actual output for a “Code signed successfully” confirmation. | Code Signing NuGet Packages with eSigner |
| Sign command fails silently or rejects credentials when password contains special characters | CLI | The -password parameter includes special characters (e.g. !, @, ^) but was not enclosed in quotes, so the shell misparses the value. | Enclose the password in quotes when it contains special characters, e.g. -password=”P!@^^ssword12″. | eSigner CodeSignTool Command Guide |
| credential_id parameter missing (multi-certificate accounts) | CLI | The account has more than one eSigner code signing certificate, so CodeSignTool cannot default to a single credential. | Explicitly pass -credential_id=<CREDENTIAL_ID> in the command; use get_credential_ids to list all credential IDs on the account. | eSigner CodeSignTool Command Guide |
| {“error_description”:”code: QuotaExceededError – message: Quota exceeded”,”error”:”server_error”} | CLI / CI-CD | The malware-scanning add-on tied to the signing credential has hit an internal usage limit, even if the account dashboard shows signings remaining. | This is not something to troubleshoot on your end. Contact SSL.com Support so the team can adjust the malware-scanning limit on the account; allow up to 1–2 hours after the fix is applied before retrying. | SSL.com Support (internal / account-specific) |
| “com.ssl.code.signing.tool.exception.CscApiException: server_error 500 at com.ssl.code.signing.tool.csc.CscApi.sendOtp(…)” | Log File | Login succeeds, but the request to send the SMS one-time password fails because of a configuration issue tied to the signing credential on SSL.com’s side. | Contact SSL.com Support to have the credential’s OTP configuration reset. | SSL.com Support (internal / account-specific) |
| CodeSignTool reports success (exit code 0) even when signing actually failed | CI/CD Pipeline | Older versions of CodeSignTool had a bug that caused it to report success regardless of the real outcome, making pipeline failures hard to detect. | Update to the latest version of CodeSignTool, which reports failures correctly. | eSigner CodeSignTool Command Guide |
| Authentication rate limit hit when signing many files in a row | CI/CD Pipeline | A new sign-in/authentication is being requested for every single file instead of reusing one session token for multiple signings. | Reuse the same authentication token for the duration of a signing session rather than authenticating before every file. High-volume/enterprise customers who still hit limits should contact SSL.com Support to discuss allowances for their account. | eSigner CodeSignTool Command Guide |
| “Error: invalid otp” (manual signing) | App/GUI | The QR code scanned into the authenticator app doesn’t match the username/password/credential ID used, or the OTP has expired. | Confirm you scanned the correct account’s QR code (not a teammate’s shared one), re-generate a fresh OTP, and re-enter it promptly since OTPs expire quickly. | eSigner CodeSignTool Command Guide |
| Invalid signature on MSI installers built with Visual Studio | App/GUI | A known compatibility issue between eSigner and MSI installers produced by Visual Studio’s packaging tools. | Build MSI installers using the WiX Toolset instead of Visual Studio as a workaround. | eSigner CodeSignTool Command Guide |
eSignerCKA (Cloud Key Adapter)
Applies to eSigner CKA, which loads eSigner certificates into the Windows certificate store for use with SignTool.exe or Certutil.exe, including CI/CD pipelines.| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| “The timestamp certificate does not meet a minimum public key length requirement” | CLI | Same ECDSA-timestamp compatibility issue as token-based signing, encountered when using eSigner CKA with SignTool. | Contact your software vendor to permit ECDSA timestamp keys, or use the legacy endpoint http://ts.ssl.com/legacy for an RSA timestamp. | Automate EV Code Signing With SignTool/Certutil Using eSigner CKA |
| “This file format cannot be signed because it is not recognized.” (signing .app files) | CLI | Attempting to sign a Microsoft Dynamics 365 Business Central .app file with eSigner CKA before the Dynamics 365 Business Central application itself is installed, so SignTool cannot parse the file format. | Install Microsoft Dynamics 365 Business Central (Server installation option) first, then sign the resulting .app file with SignTool via eSigner CKA. | How to Digitally Sign .app Files using eSigner CKA |
| VBA macro signing fails silently / signature rejected | App/GUI | VBA sends eSigner a SHA1 hash of the code, but eSigner requires SHA256 or greater. | Add the DWORD registry value V1HashEnhanced under HKCU\SOFTWARE\Microsoft\VBA\Security and set it to 2 (SHA256), 3 (SHA384), or 4 (SHA512) per Microsoft’s guidance, then re-sign. | How to Digitally Sign VBA Macros using eSigner CKA |
| Certificate not appearing / not usable via SignTool | App/GUI | eSigner CKA is not installed, or the signing mode (manual/automated) and certificate type (production/test) were not configured. | Install eSigner CKA and explicitly configure the signing mode and certificate type before attempting to sign; confirm enrollment on eSigner first. | Automate EV Code Signing With SignTool/Certutil Using eSigner CKA |
| “Signing credentials not configured. Make sure certificate is issued before signing” + “Failed to retrieve certificates id. Error: Object reference not set to an instance of an object.” / (CLI) “Unhandled Exception: System.NullReferenceException: Object reference not set to an instance of an object. at eSignerCKATool.eSignerCKATool.Config(CommandLineInfo commandLineInfo)” | App/GUI + CLI | Either a leftover/invalid signing credential on the account (such as an old, unused credential) that this version of eSigner CKA doesn’t skip over correctly, or a certificate that shows as “Issued” on the account but hasn’t finished linking to the cloud signing backend yet. | First, try deleting the local config folders %APPDATA%\eSignerCKA and %LOCALAPPDATA%\eSignerCKA, then re-run the config command, making sure to use -mode product and your account username (not your email address). If that doesn’t help, contact SSL.com Support — removing an invalid credential or finishing certificate setup requires backend action. CodeSignTool can be used as an alternative in the meantime. | SSL.com Support |
| eSigner CKA crashes immediately after signing in (Windows Event Viewer): “.NET Runtime Event 1026 — System.AccessViolationException in eSignerCSP.UI.Utils.CspWrapper.C_UnloadAllCertificate during DisplayData”; persists after reboot/reinstall | Log File / App Crash | A known defect in older versions of eSigner CKA can cause it to crash on startup even when the certificate store is empty; it’s sometimes related to the leftover-credential issue. | This requires an updated eSigner CKA release. Contact SSL.com Support so it can be escalated to engineering. Use CodeSignTool for signing in the meantime. | SSL.com Support (internal / account-specific) |
| “[Error] Could not find file ‘C:\Program Files (x86)\SSL Corp eSigner CKA\eSignerKSP64.dll’.” / “[Error] Could not find file ‘C:\Program Files (x86)\SSL Corp eSigner CKA\eSignerKSP32.dll’.” | Log File | Certain eSigner CKA installer builds are missing these supporting files after an internal component rename — this is not caused by anything on your computer. | Fully reinstall eSigner CKA: remove both the Program Files and AppData folders, reboot, then reinstall. Signing may still work even with this message present. If the files are still missing afterward, contact SSL.com Support for a corrected installer. | SSL.com Support |
| “Invalid OTP” in automated/automatic signing mode only (manual mode works) | App/GUI | Usually an incorrect TOTP secret, a TOTP secret that doesn’t match the credential ID in use, or the computer’s clock being out of sync. Occasionally caused by a leftover configuration file from a previous install conflicting with the current one. | Confirm you’re using the correct TOTP secret for the credential ID in question and that your system clock is accurate. If it persists, delete %APPDATA%\eSignerCKA and %LOCALAPPDATA%\eSignerCKA and reinstall eSigner CKA. | SSL.com Support |
| “SignerSign() failed. (-2146893821/0x80090003 NTE_BAD_KEY)” / “signtool.exe: SignTool Error: An unexpected internal error has occurred.” — during high-volume batch signing (typically after ~100 files) | CLI / CI-CD | The malware-scanning feature on the account reaches an internal usage limit during high-volume batch signing, interrupting the signing session. | Contact SSL.com Support to have the malware-scanning limit adjusted for high-volume signing on the account. As a workaround, sign in smaller batches and refresh credentials (config -r) between batches. | SSL.com Support (internal / account-specific) |
| “key status is disabled” on every eSigner action (signing, PIN reset, QR reset) | App/GUI / CLI | The signing credential has been disabled on SSL.com’s backend. | Contact SSL.com Support — only SSL.com can re-enable a disabled signing credential; this can’t be resolved from the customer’s side. | SSL.com Support (internal / account-specific) |
eSignerMalware Scan (Pre-Signing)
Applies to SSL.com’s optional pre-signing Malware Scan feature, available across the eSigner toolkit (Express, CodeSignTool, API, CKA).| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| “Error: hash that needs to sign is a malware object hash” | CLI | Malware Scan detected a positive match on the file submitted and automatically halted the signing process as designed. | This is expected behavior when malware is detected — review and remediate the flagged file before resubmitting; it is not a configuration error unless scanning wasn’t intended to be on. | How to Use Pre-Signing Malware Scan with SSL.com eSigner |
| Malware Scan not applying to signing requests | App/GUI | The “malware blocker enabled” radio button was not activated alongside “signing credential enabled” in the account’s Signing Credentials section. | In the SSL.com certificate order page, under Signing Credentials, ensure both “signing credential enabled” and “malware blocker enabled” are selected before signing. | How to Use Pre-Signing Malware Scan with SSL.com eSigner |
CI/CD Pipeline Integration (GitHub Actions, GitLab CI, Jenkins, Travis, Azure DevOps)
Applies to automated eSigner CodeSignTool or eSigner CKA signing steps embedded in CI/CD pipeline scripts.| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| Signing step fails partway through the pipeline with no clear cause | CI/CD Pipeline | Typographical errors or erroneous line breaks were introduced into the pipeline script (YAML/Groovy/etc.) around the signing step. | Carefully review the pipeline script for spelling mistakes and stray line breaks; compare against SSL.com’s published sample pipelines (e.g. github.com/SSLcom/codesigner-github-sample) before troubleshooting further. | Cloud Code Signing Integration with GitHub Actions |
| Config parameter typo, e.g. -topt used instead of -totp | CI/CD Pipeline | A misspelled parameter name in the pipeline configuration file. | Correct the parameter name to -totp (not -topt) in the pipeline script. | eSigner CodeSignTool Command Guide |
| SignTool error when using the x64 build inside the pipeline runner | CI/CD Pipeline | The pipeline runner’s environment is incompatible with the x64 build of signtool.exe when used with eSigner CKA. | Switch the pipeline step to invoke the x86 version of signtool.exe instead. | How to Integrate eSigner CKA with CI/CD Tools |
| “The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.” / “Error: invalid_grant” | CI/CD Pipeline | Several possible causes: the account password was reset but the pipeline still has the old one saved; the pipeline is using the email address instead of the account username; special characters in the password (e.g. $, !, backticks) aren’t properly quoted in the script; the same credentials work locally but fail specifically from the CI/CD provider’s servers; or password-based API login isn’t enabled for the account. | Use the account username (not the email address) for authentication. If the password was recently reset, update the saved credential in the pipeline. Wrap credential variables in quotes in the pipeline script, especially if the password has special characters. Test the credentials locally first with CodeSignTool’s get_credential_ids command. If it still fails — particularly if it only happens from the CI/CD provider and not locally — contact SSL.com Support, since it may require enabling API login or refreshing account authorization on the backend. | SSL.com Support |
| “Can not retrieve credential id. Error: Unexpected character encountered while parsing value: <. Path ”, line 0, position 0.” | CI/CD Pipeline | A brief hiccup on SSL.com’s servers returned a webpage instead of the expected data. This is usually temporary. | Wait a moment and re-run the command. If it happens repeatedly, contact SSL.com Support. | SSL.com Support |
Certificate Lifecycle & General Errors
Errors that can occur regardless of signing method — related to certificate validity, chain of trust, and key handling.| Error / Symptom | Interface | Likely Cause | Resolution | Source |
| Certificate has expired or is no longer trusted after signing | N/A | A code signing certificate expired, and previously signed code was not timestamped, so its signature validity is now tied to the certificate’s expiration. | Obtain a new certificate and re-sign affected code going forward; always timestamp signatures at signing time so validity extends beyond certificate expiry. | What is a Code Signing Certificate? |
| Certificate issued with an unexpectedly short validity period | N/A | CA/Browser Forum requirements now cap newly issued publicly trusted code signing certificates at 458 days, effective February 27, 2026. | This is an industry-wide requirement, not an error — certificates may need reissuance more often within the same purchased term, at no extra cost. | What is a Code Signing Certificate? |
Quick Reference: Which Guide Should I Start With?
- Signing with a physical YubiKey or SafeNet token: start with Using Your Code Signing Certificate
- Signing with eSigner CodeSignTool: start with eSigner CodeSignTool Command Guide
- Signing with eSigner Cloud Key Adapter (CKA): start with How to Automate EV Code Signing With SignTool.exe or Certutil.exe Using eSigner CKA (Cloud Key Adapter)
- Automating signing in CI/CD with eSigner CKA: start with How to Integrate eSigner CKA with CI/CD Tools
- Automating signing in CI/CD with eSigner CodeSignTool
- Cloud Code Signing Integration with CircleCI
- Cloud Code Signing Integration with GitHub Actions
- Cloud Code Signing Integration with GitLab CI
- Cloud Code Signing Integration with Travis CI
- Cloud Code Signing Integration with Jenkins CI
- Cloud Code Signing Integration with Azure DevOps
- Cloud Code Signing Integration with BitBucket
