Sign from your machine
signtool with SimplySign, timestamping, and how to check a signature actually took. This is signing you run yourself, at the moment you ship. It is not build-server or CI signing, and the section below says exactly why.
Before you follow any of this
The tools here are Microsoft’s (signtool, from the Windows SDK) and Certum’s (SimplySign), so the commands work today against a certificate you already hold. For a certificate ordered through Klarseal we promise no issuance date, because Certum reviews the documents and checks the named person’s identity on its own schedule.
Not build-server or CI signing
A Certum cloud code signing certificate cannot sign unattended, and Klarseal is not building a way around that. Three facts make it so:
- The private key is generated inside Certum’s hardware security module and stays there. There is no
.pfxto copy onto a runner and no password that would help if there were. - Every signing operation is authorised through the SimplySign app by the person holding the account. A pipeline has nobody to do that.
- Since June 2023 the CA/Browser Forum requires code signing keys to be in certified hardware, so no supplier can hand you an exportable key file for a build agent.
What teams do instead is sign on a release workstation as an explicit, human step at the end of the pipeline — CI builds the artefact, a person signs and publishes it. If your release genuinely has to be signed with nobody present, that is a different product. Tell us before you order and we will say so rather than sell you this one.
Three commands, in order
Once Certum has issued a certificate into SimplySign, signing is a single command. Install the SimplySign desktop app and sign in; the certificate appears in the Windows certificate store where signtool reaches it by subject name.
1Check the certificate is visible
With the app running and logged in, list your personal store. The subject is your company’s legal name exactly as it appears in Brønnøysundregistrene — copy it from here rather than typing it, because signtool matches it literally.
PowerShell Get-ChildItem Cert:\CurrentUser\My | Format-List Subject, NotAfter, Thumbprint2Sign, with a timestamp
The timestamp is not optional in practice: without it the signature stops validating the day the certificate expires. Certum’s timestamp service is included with the certificate.
signtool · Windows SDK 10.0.22621 signtool sign /fd SHA256 /tr http://time.certum.pl /td SHA256 ^ /n "Archi Systems AS" setup.exeWorth knowing
Each signing operation is authorised in the SimplySign app. If the app is not logged in, signtool reports that the private key cannot be accessed — that message means “nobody approved this”, not that the certificate is broken.
3Verify
The output names the publisher and the timestamp authority. That publisher name is what Windows shows instead of “Unknown publisher”. Run this in CI too: it needs no key, and it catches a release that shipped unsigned.
signtool · verification signtool verify /pa /v setup.exe
Step by step, with the SimplySign install and the failure messages in full, in the guideSign an .exe with signtool. Sources: Microsoft signtool reference; Certum SimplySign documentation; CA/Browser Forum baseline requirements for code signing. Checked 5 September 2026.
Not sure which certificate you need?
Installers, drivers, PowerShell modules or an MSIX package — the answer changes, and so does whether Standard or EV is the right one. Kernel-mode drivers are the clearest case for EV.
Questions about signing
Certificates are issued by Certum, a certificate authority on the EU Trusted List, and the key never leaves their hardware security module.
Can I sign in GitHub Actions, Azure Pipelines or Jenkins?
No — not with the Certum cloud certificates Klarseal is preparing to sell. The private key is generated inside Certum’s hardware security module and cannot be exported, and each signing operation is authorised by the person holding the SimplySign account. There is no key file, no password and no unattended credential a runner could hold, so a pipeline cannot sign on its own. Teams that need this either sign on a release workstation as a deliberate step or buy a product built for unattended signing. If your release has to be signed with nobody present, tell us before you order and we will say plainly that this is not the right product rather than sell it to you.
Why does the private key have to live in Certum’s HSM?
Since June 2023 the CA/Browser Forum baseline requirements say code signing private keys must be held in certified hardware. That leaves three options: a shipped USB token, hardware you operate yourself, or a cloud signing service. Certum’s cloud products take the third route, which is why there is no token to wait for at customs — and also why signing is an interactive operation rather than a file you copy onto a build agent.
What happens if I forget the timestamp?
The signature stops validating when the certificate expires, instead of staying valid for the life of the file. A timestamp from a trusted authority records when the signature was made, so Windows keeps trusting it afterwards. Use /tr with an RFC 3161 timestamp URL and /td SHA256 on every signature — Certum’s timestamp service is included with the certificate, and there is no reason to ever sign without it.
signtool says the private key cannot be accessed. What is wrong?
Almost always the SimplySign desktop app is closed or signed out, so the virtual card holding your certificate is not mounted. Open the app, sign in, confirm the certificate appears in Cert:\CurrentUser\My, and run the command again. If the subject name in /n does not match your company’s legal name exactly as Certum issued it, signtool will also fail to find a certificate — copy the subject out of the listing rather than typing it.
Does EV make Windows stop warning about my installer immediately?
No. Since March 2024 an EV certificate no longer clears the SmartScreen warning on sight. Both Standard (OV) and EV build reputation over the first real downloads, and a consistent publisher name plus a timestamp on every build is what shortens that. Resellers still promising instant removal are out of date. What a certificate does immediately is replace "Unknown publisher" with your company name.