Sign code from your CI/CD pipeline — no hardware token required
eSigner for Code is SSL's cloud HSM-backed code signing service. Sign Windows executables, drivers, installers, and scripts directly from GitHub Actions, Jenkins, Azure DevOps, and other CI/CD platforms — using an EV-level cloud HSM, without shipping hardware tokens to build servers or developers.
Two eSigner products — make sure you're in the right place
What is eSigner for Code?
Traditional EV Code Signing requires a physical USB hardware token — a problem for modern CI/CD pipelines. eSigner for Code solves this by hosting your private key in SSL’s FIPS 140-2 validated cloud HSM. You sign code via SSL’s signing API or the eSigner CKA (Crypto Key Adapter), which integrates directly with standard signing tools like signtool.exe.
eSigner for Code enables:
EV signing without hardware
Cloud HSM satisfies CA/B Forum EV requirements — sign with EV certificates in headless build environments, no USB token.
CI/CD native integration
eSigner CKA integrates with signtool.exe — works in any pipeline that supports standard Windows signing.
Authenticode-compatible formats
.exe, .dll, .msi, .cab, .sys, .ps1, and more — any format accepted by the Windows Authenticode toolchain.
Automated headless signing
Sign in fully automated build environments without user interaction — private key never leaves SSL's cloud HSM.
Key Benefits
CI/CD Integrations
eSigner CKA is compatible with all major CI/CD platforms that support signtool.exe or standard signing APIs:
How It Works
Purchase & Pricing
1. Select Code Signing Certificate
2. Select Key Storage & Delivery
eSigner Cloud Signing
Sign anywhere using eSigner.com. No hardware required.Select the monthly or annual signature volume tier. Any unused signatures will roll over into the next month or year if there is an active certificate. Each tier provides a certain number of included credentials which are pre-selected based on the selected tier. Extra credentials can be purchased at $20 per month. New certificates will receive 30-days free of eSigner cloud signing. After the first 30 days, your monthly or annual subscription fees will be applied. For multi-year subscription discounts, high-volume signature packages and custom solutions, please contact sales.
3. Validation Speed (optional)
Choose how quickly your organization or identity is validated before your certificate is issued.
Standard
3ā5 day validation Ā· 2ā3 day US shipping Validation completed after all agreements, entity info submitted, and a successful callback to a listed phone number. International shipping tracked; delivery subject to customs. IncludedExpedited
2 business day validation Ā· overnight US delivery 2 business days priority validation from first complete submission and callback. Token shipped overnight in continental US. +$599.00Compliance & Standards
CA/B Forum EV Code Signing
Cloud HSM satisfies FIPS 140-2 requirement for EV private key storage — accepted by all major CAs.
FIPS 140-2
SSL's cloud HSM is FIPS 140-2 validated. Keys generated and stored in certified hardware, never exported in plaintext.
CSC API
SSL implements the Cloud Signature Consortium API for programmatic signing integration and enterprise automation.
Frequently asked questions
Yes — eSigner is a signing service that works with a code signing certificate. You purchase the certificate (IV, OV, or EV) first, then enroll it in eSigner separately.
Yes — this is a primary use case. eSigner's cloud HSM satisfies the FIPS 140-2 hardware requirement for EV private key storage, so you get full EV-grade trust without a physical USB token.
eSigner CKA is a Windows component that wraps signtool.exe. For Linux-based signing, use the eSigner CSC API directly. Contact SSL for guidance on cross-platform signing workflows.
No — you want eSigner for Documents. It supports PDF signing via the eSigner Express web app and high-volume automated signing via eSealing.
IV (Individual Validated), OV (Organization Validated), and EV (Extended Validation) code signing certificates from SSL are all compatible. EV is the most common choice for CI/CD pipelines as it provides instant SmartScreen reputation.
Ready to sign code from your pipeline?
Related products
EV Code Signing
Instant SmartScreen reputation and kernel-mode driver signing — most commonly used with eSigner for Code.
OV Code Signing
Organization-validated code signing compatible with eSigner for Code — ideal for standard software distribution.
eSigner for Documents
Sign PDFs, contracts, and official documents via eSigner Express or automate at scale with eSealing.
