HSM Code Signing
HSM based code signing keeps software signing keys inside a protected hardware security module, allowing organizations to control how certificates are generated, stored, accessed, and used to sign software.
What Is HSM Code Signing?
HSM Code Signing is a software signing architecture in which the private key associated with a code signing certificate is generated, stored, and used inside a hardware security module or an approved HSM backed environment. The software artifact is created by the development or release system, while the protected cryptographic operation is handled inside the HSM boundary.
The purpose is not to make the certificate itself more trustworthy. The certificate establishes the publisher identity and the certificate chain establishes the trust relationship. The HSM addresses a different problem: protecting the private key that can create valid signatures.
Code Signing Certificate
Associates the signing public key with the validated software publisher and defines the certificate's intended use under the applicable policy.
Private Key
Creates the cryptographic signature. Anyone who gains unauthorized control of this key may be able to create signatures associated with the certificate.
Hardware Security Module
Provides a protected cryptographic boundary for key generation, storage, activation, signing operations, and other key lifecycle controls supported by the HSM.
Protected Signing Environment
Combines the certificate, protected private key, signing software, authentication, authorization, logging, and release controls into one operational architecture.
HSM Is Not a Code Signing Certificate
HSM Code Signing Certificate is a common search phrase, but HSM is not a certificate validation type. It describes the protection and use of the private key. A certificate can be organization validated or extended validated while its corresponding key is protected by an HSM, subject to the certificate authority's supported configuration.
| Component | Primary role | What it answers |
|---|---|---|
| Certificate | Publisher identity and public key binding | Who is associated with the signed software? |
| Private key | Creates the digital signature | Can this signing authority create a valid signature? |
| HSM | Protects the private key and controls cryptographic operations | Where and under what controls is the signing key used? |
| Certificate validation | Identity verification by the CA | How was the certificate subject validated? |
OV and EV describe certificate validation. HSM describes how the signing private key is protected. The two concepts solve different security and identity requirements.
Why Code Signing Uses HSMs
A code signing private key can authorize software as coming from the certificate subject. That makes key custody a security boundary worth separating from ordinary development infrastructure. An HSM can place the key inside a hardware protected environment and restrict how cryptographic operations are invoked.
Private key protection
The key can remain within a protected cryptographic module rather than being stored as an ordinary software file on a build machine.
Non exportability
Supported HSM configurations can prevent the private key from being exported, reducing the number of systems that can possess the signing authority.
Centralized key custody
Enterprise teams can manage signing keys within a defined security environment rather than distributing signing tokens across release machines.
Access control
HSMs and their surrounding signing systems can enforce authentication and authorization controls for cryptographic operations.
Separation of duties
Build, signing, security, and release privileges can be separated when the HSM architecture and signing platform support those controls.
Auditability
HSM and signing service logs can provide evidence of key use and administrative activity when the implementation records those events.
The current CA/Browser Forum Code Signing Baseline Requirements require subscriber private keys for public code signing certificates to be protected using an appropriate hardware cryptographic module or qualifying cloud based HSM backed solution, with specific requirements for non exportability and verification.
HSM Code Signing vs Hardware Token
A hardware token and an HSM both protect signing keys with hardware based security, but their operating models are different. A USB token is often designed around one controlled signing workstation or user. An HSM is generally designed for centralized cryptographic operations, multiple applications, enterprise access controls, or automated signing environments.
| Factor | Hardware token | HSM |
|---|---|---|
| Key storage | Secure token, often USB based | Hardware security module |
| Typical operating model | Individual or small team signing | Centralized or enterprise signing |
| Centralized signing | More limited | Designed for centralized cryptographic services |
| CI/CD | Requires controlled access to the token and host | Well suited to automated signing when integrated correctly |
| Multiple users | More constrained | Can support richer access control through HSM and signing layers |
| Audit | Depends heavily on token and host software | Can integrate with centralized HSM and signing service logs |
| Infrastructure | Lower operational complexity | Higher operational and integration complexity |
| Key custody | Physical token custody | Controlled HSM environment |
GlobalSign documents HSM based installation for Standard and EV Code Signing and requires a compliant HSM for key generation and CSR creation.
HSM Code Signing vs Cloud Code Signing
HSM Code Signing focuses on the security boundary around the signing private key. Cloud Code Signing focuses on a cloud delivered signing service. The two can overlap because a cloud signing service can use an HSM or cloud HSM to protect its keys.
| Factor | HSM Code Signing | Cloud Code Signing |
|---|---|---|
| Main focus | Hardware protected private key | Cloud based signing delivery |
| HSM location | Customer or provider environment | Usually cloud based |
| Customer managed HSM | Yes | Possible |
| Cloud HSM | Yes | Yes |
| Managed signing | Possible | Common |
| Physical HSM | Possible | Usually not directly operated by the customer |
| Core question | How is the key protected? | Where and how is signing delivered? |
Teams comparing the service layer can use Cloud Code Signing, while teams evaluating the signing location can use Remote Code Signing. Both can include HSM backed architectures.
Customer HSM vs Cloud HSM vs Managed HSM
The HSM deployment model determines how much control the organization keeps over infrastructure and how much operational work it accepts. The certificate authority's supported issuance and attestation process also matters.
| Model | Infrastructure control | Operational effort | Typical use |
|---|---|---|---|
| Customer managed HSM | Highest | Highest | Enterprise teams with direct infrastructure control |
| Cloud HSM | High | Medium | Cloud based enterprise key environments |
| Provider managed HSM | Medium | Lower | Managed signing with provider operated infrastructure |
| Managed cloud signing | Lower | Lowest | Distributed teams and automated CI/CD |
SSL.com currently documents support for AWS CloudHSM, Azure Dedicated HSM, and Google Cloud HSM for code signing certificate issuance, including IV, OV, and EV configurations, subject to its attestation process.
HSM Code Signing Architecture
A production architecture separates artifact creation from the private key operation. The build system creates the software, authenticates to the signing layer, requests a signature, and then verifies the signed artifact before release.
Software Build → Unsigned Artifact → Signing Request → Authentication → Authorization → HSM → Private Key Operation → Digital Signature → Timestamp → Signed Artifact → Verification
How the Private Key Is Protected in an HSM
The security value of an HSM depends on the complete lifecycle, not simply the presence of hardware. A strong code signing architecture defines how the key is generated, activated, used, backed up where supported, recovered, rotated, revoked, and destroyed.
Key generation
Generate the signing key within the HSM or qualifying cloud HSM boundary so the private key does not begin its lifecycle as an ordinary exportable file.
Non exportability
Configure the key so it cannot be exported when the HSM and certificate policy require a non exportable key.
Authentication
Require the credentials, roles, certificates, service identities, or other controls needed to activate and use the key.
Role separation
Separate HSM administration from signing authorization where the platform supports distinct roles.
Backup and recovery
Follow the HSM vendor's supported backup architecture and the CA's rules for preserving or recovering code signing keys.
Key destruction
Use documented destruction procedures when a key reaches the end of its lifecycle or must be removed after compromise.
The current CA/Browser Forum requirements describe key generation, protection, activation, deactivation, destruction, backup, verification and related controls for subscriber private keys.
HSM Standards for Code Signing
FIPS and Common Criteria are security evaluation frameworks and certification schemes, not marketing synonyms for security. A code signing buyer should verify the exact module, certification level, applicable certificate authority requirement, and supported configuration.
FIPS 140
FIPS 140 validation applies to cryptographic modules. Code signing requirements can reference a specific level or an equivalent security evaluation. The applicable level depends on whether the requirement addresses a subscriber key, signing service, or CA infrastructure.
Common Criteria
Common Criteria evaluates security properties against defined protection profiles or security targets. Code signing requirements may reference EAL4+ or an equivalent qualifying configuration.
The current CA/Browser Forum Code Signing Baseline Requirements distinguish subscriber private key protection from signing service key protection. Subscriber keys can use a qualifying HSM with at least the required hardware security characteristics, while signing services have separate requirements for their cryptographic module and authentication controls.
HSM Code Signing Certificate Requirements
Before ordering a certificate for an HSM, confirm the certificate authority's exact requirements. The process can include certificate validation, HSM certification, key generation, CSR creation, attestation, certificate import, and signing software integration.
GlobalSign's current HSM installation process, for example, requires the CSR to be generated on a FIPS 140-2 Level 2 compliant HSM and then imports the issued certificate into that HSM.
OV and EV Certificates With HSM
HSM support does not turn an OV certificate into an EV certificate. OV and EV remain certificate validation models. The HSM is the key protection layer used with the certificate.
| Factor | OV | EV |
|---|---|---|
| Organization validation | Yes | Yes |
| Enhanced validation requirements | No | Yes |
| HSM support | Provider dependent | Provider dependent |
| Protected private key | Required according to current public code signing requirements | Required according to current public code signing requirements |
| CI/CD | Possible with supported architecture | Possible with supported architecture |
| Driver signing | Platform dependent | Platform dependent and subject to Microsoft requirements |
For current certificate specific context, the SSL.com OV Code Signing and SSL.com EV Code Signing pages separate certificate validation from the key storage architecture.
HSM Code Signing Providers
Provider comparison should focus on documented HSM provisioning, supported certificate types, attestation, signing interfaces, and automation. Selling a code signing certificate does not by itself prove that a provider supports customer managed HSM or cloud HSM issuance.
DigiCert
DigiCert documents HSM based Code Signing and EV Code Signing configurations and separate requirements for approved hardware or cloud HSM environments. Its KeyLocker service provides a managed cloud signing architecture.
DigiCert KeyLocker is the relevant internal resource for the managed cloud signing layer.
GlobalSign
GlobalSign documents HSM based Standard and EV Code Signing installation, including CSR generation on a compliant HSM and certificate import into the HSM. Its current documentation also covers Azure Key Vault based configurations.
Certificate context is available through GlobalSign OV Code Signing and GlobalSign EV Code Signing.
SSL.com
SSL.com documents HSM attestation for supported configurations including AWS CloudHSM, Azure Dedicated HSM, and Google Cloud HSM. It also offers eSigner, a managed cloud HSM signing service.
The certificate layer is covered in SSL.com OV Code Signing and SSL.com EV Code Signing.
Sectigo
Sectigo offers OV and EV Code Signing certificates, but the exact current HSM provisioning configuration should be verified before presenting it as a supported customer HSM or cloud HSM option.
Use the Sectigo OV Code Signing and Sectigo EV Code Signing pages for certificate context.
Provider capabilities change. HSM support should be checked against the current CA documentation, certificate ordering workflow, attestation requirements, and supported HSM list.
HSM Code Signing Provider Comparison
The table below separates documented capabilities from areas that require current provider verification. It is designed as a commercial research reference rather than a provider ranking.
| Provider | OV | EV | Customer HSM | Cloud HSM | Managed signing | CI/CD | Current HSM evidence |
|---|---|---|---|---|---|---|---|
| DigiCert | Yes | Yes | Supported | Supported | KeyLocker | Supported | HSM requirements and cloud configuration documented |
| GlobalSign | Yes | Yes | Supported | Azure Key Vault HSM documented | Verify | Provider dependent | HSM installation and Azure Key Vault documentation |
| SSL.com | Yes | Yes | Supported configurations | AWS, Azure and Google documented | eSigner | Supported | HSM attestation and eSigner documentation |
| Sectigo | Yes | Yes | Verify | Verify | Verify | Verify | Verify current HSM configuration |
Current CA requirements also mean that the technical details behind a provider's signing service matter. A service that stores subscriber keys in an HSM must meet the applicable signing service controls, including authentication and key protection requirements.
Choose the Right HSM Signing Architecture
Compare HSM requirements with your certificate validation needs, signing workflow, and software release environment before choosing a provider.
HSM Code Signing Pricing
HSM Code Signing pricing is not the same as the price of a code signing certificate. The total cost can include the certificate, HSM infrastructure, cloud HSM usage, provider attestation, managed signing, integration work, administration, monitoring, backup, support, and renewal.
Certificate
The Code Signing or EV certificate establishes publisher identity and the applicable validation model.
HSM
Customer owned or rented hardware can introduce purchase, provisioning, support, and lifecycle costs.
Cloud HSM
Cloud HSM pricing can include HSM instances, storage, network, key operations, and provider specific charges.
Managed signing
A managed service can replace some infrastructure work with subscription, usage, credential, or signing volume costs.
Total cost = certificate + HSM or signing service + integration + operations + support.
SSL.com currently publishes separate HSM attestation fees and managed eSigner pricing, illustrating why certificate price alone does not represent the cost of an HSM based signing architecture.
HSM Code Signing Cost Comparison
| Provider | Certificate | Customer HSM | Cloud HSM | Managed signing | Pricing model |
|---|---|---|---|---|---|
| DigiCert | Current provider quote | Supported | Supported | KeyLocker | Certificate plus service configuration |
| GlobalSign | Current provider quote | Supported | Azure Key Vault HSM documented | Verify | Certificate plus infrastructure |
| SSL.com | Current provider pricing | Supported configurations | AWS, Azure and Google documented | eSigner | Certificate plus HSM or service costs |
| Sectigo | Current provider quote | Verify | Verify | Verify | Current provider pricing |
The table intentionally avoids unverified certificate prices. HSM and managed signing costs can vary by region, contract, usage, infrastructure, and purchasing channel.
HSM Code Signing for CI/CD
CI/CD is where HSM based signing becomes an architecture decision rather than a workstation feature. The build runner should be able to request a signature without receiving an exportable copy of the private key. The signing stage should also remain isolated from ordinary build credentials.
GitHub Actions
Use a supported signing adapter, service credential, or provider integration rather than placing the private key in repository secrets.
GitLab CI
Separate build credentials from signing authorization and keep the private key inside the HSM boundary.
Jenkins
Use the provider's supported HSM middleware, signing service, or adapter and restrict the Jenkins credential that can invoke signing.
Azure DevOps
Use a supported HSM or signing service integration and keep signing authorization separate from general pipeline permissions.
TeamCity
Integrate through the supported HSM middleware, provider CLI, API, or signing adapter.
Enterprise build systems
Define a centralized signing service or HSM interface so multiple release pipelines use the same controlled key environment.
DigiCert documents automated signing integrations including GitHub and Jenkins, while SSL.com documents CKA and CodeSignTool based automation.
HSM Code Signing With SignTool
Windows Authenticode signing can use different interfaces depending on the HSM vendor and middleware. A single SignTool command cannot be treated as universal because certificate access can be exposed through the Windows Certificate Store, CNG/KSP, CSP, PKCS#11 middleware, a provider adapter, or another signing interface.
Windows Certificate Store
The certificate may be visible to Windows signing tools while the corresponding private key remains protected by the HSM integration.
CNG and KSP
Modern Windows cryptography providers can expose HSM protected keys to compatible applications.
PKCS#11
HSM middleware can expose cryptographic operations through PKCS#11 where the signing software supports it.
Timestamp and verify
Sign the artifact, apply a trusted timestamp where appropriate, then verify the signature and certificate chain before release.
The exact middleware and configuration should come from the HSM vendor and certificate provider. The technical workflow should be validated before automation is deployed.
HSM Code Signing for Java
Java code signing can use an HSM protected key through a Java security provider or PKCS#11 interface. The release pipeline creates the JAR, the signing tool accesses the protected key, and the resulting artifact carries the certificate based signature and applicable timestamp information.
JAR signing
Sign the final Java artifact after build and test stages have completed.
jarsigner
Use the Java signing tool with the HSM provider or PKCS#11 integration supported by the environment.
Certificate chain
Ensure the signed artifact includes the certificate information required by the consuming Java environment.
Timestamping
Use a supported timestamping workflow so signatures can remain verifiable according to the relevant Java signing model.
HSM Code Signing for Windows Drivers
Driver signing is a separate platform workflow from ordinary application signing. The HSM protects the signing key, but it does not replace Microsoft's driver submission, validation, or distribution requirements.
Driver signing requirements
Confirm the applicable Microsoft driver signing path, certificate requirements, submission process, and provider support before designing the HSM workflow.
HSM key protection
Generate and use the signing key inside the approved HSM environment while preserving the required Microsoft signing workflow.
SSL.com currently identifies EV Code Signing as part of its supported Windows driver signing and Windows Hardware Dev Center workflows.
HSM Code Signing for Firmware and Other Artifacts
HSM based signing is not limited to desktop executables. The same key protection principle can apply to firmware, IoT software, libraries, application packages, drivers, containers, and other artifacts when the target ecosystem accepts the certificate and signature format.
Firmware
Protect the firmware signing key and integrate the HSM into the release process while following the device platform's signing and boot chain requirements.
IoT software
Separate device software signing authority from ordinary build infrastructure and protect the key used to authenticate updates.
Executables and libraries
Use the HSM as the protected key boundary for supported Authenticode or ecosystem specific signing operations.
Containers
Container image signing can use different trust systems and keys, so confirm that the selected HSM integration supports the exact container signing technology.
DigiCert documents code signing use cases that include firmware, drivers, applications, containers, mobile applications and source code artifacts. HSM compatibility and certificate acceptance still vary by signing ecosystem.
HSM Code Signing Security Architecture
A secure HSM deployment protects more than the physical key. The surrounding identity, authorization, network, logging, backup, recovery, and release controls determine how safely the signing authority is used.
Key generation
Generate the key inside the HSM or qualifying cloud HSM boundary.
Key non exportability
Prevent extraction of the private key where the architecture and certificate requirements call for it.
Authentication
Control who or what can invoke the key through supported HSM and signing service authentication.
Authorization
Control which users, workloads, certificates, or release systems may sign.
Separation of duties
Keep build, signing, administration, security, and release privileges separate where practical.
Audit
Record signing and administrative events so suspicious activity can be investigated.
Backup
Use only supported backup mechanisms and understand whether the CA permits recovery of the signing key.
Disaster recovery
Plan for HSM failure, replacement, certificate continuity, and signing service recovery.
Revocation
Maintain a certificate revocation procedure for key compromise or other applicable revocation events.
HSM Code Signing and Software Supply Chain Security
An HSM protects one of the most sensitive assets in a software release process: the signing private key. It does not make the entire software supply chain trustworthy. A compromised build system can still submit a malicious artifact for legitimate signing if the signing architecture does not verify release context and authorization.
Source code
Protect repositories, branches, commits, dependencies, and developer credentials.
Build system
Harden CI runners and build dependencies because HSM protection does not validate what the pipeline builds.
Signing authorization
Restrict which pipeline, user, environment, or release event can invoke the signing key.
Release repository
Protect signed artifacts and deployment credentials after the signing operation is complete.
HSM protects the signing key. It does not validate the software being signed.
HSM Code Signing Access Control
Access should be designed around the principle that the ability to build software is not automatically the ability to authorize a production signature. HSM platforms and signing services differ, so controls should be documented against the actual implementation.
HSM Key Compromise and Incident Response
A compromised code signing private key requires a response that covers both the certificate and the signing infrastructure. The exact revocation and replacement procedure comes from the certificate authority, while the HSM and pipeline response comes from the organization's security process.
Keep the response procedure separate from general certificate renewal. Compromise can require revocation and replacement rather than simply waiting for certificate expiration.
HSM Code Signing vs Remote Code Signing
HSM Code Signing and Remote Code Signing describe different dimensions of the architecture. An HSM describes the security boundary around the private key. Remote signing describes where the signing operation is performed relative to the build or release machine.
| Factor | HSM Code Signing | Remote Code Signing |
|---|---|---|
| Core focus | Private key protection | Signing location |
| HSM required | Core architecture | Not necessarily |
| Remote signing | Possible | Yes |
| Local HSM | Possible | Possible |
| Cloud HSM | Possible | Possible |
| Managed signing | Possible | Common |
| Certificate type | IV, OV, or EV depending on provider | IV, OV, or EV depending on provider |
The Remote Code Signing page focuses on signing location and service architecture, while this page focuses on the protected key boundary.
HSM Code Signing vs Cloud Code Signing
Cloud Code Signing focuses on provider operated cloud signing services. HSM Code Signing focuses on hardware protected private keys regardless of whether the HSM is on premises, colocated, cloud hosted, or provider managed.
Cloud Code Signing
Use Cloud Code Signing when the main research question is which cloud signing service, provider, integration, or pricing model fits the release workflow.
HSM Code Signing
Use this page when the main question is how the signing private key should be protected, where the HSM should run, and what HSM configuration the CA accepts.
Cloud Code Signing = where the service runs. Remote Code Signing = where the signing operation happens. HSM Code Signing = how the private key is protected.
How to Choose an HSM Code Signing Solution
The correct HSM architecture depends on certificate requirements, signing platforms, operational control, automation, recovery requirements, and total cost. Start with the certificate authority's supported HSM configurations before choosing infrastructure.
HSM Code Signing Buying Checklist
Use this checklist before ordering a certificate or deploying an HSM based signing environment.
HSM Code Signing FAQ
What is HSM Code Signing?
HSM Code Signing protects the private key associated with a code signing certificate inside a hardware security module or qualifying HSM backed environment. The HSM performs or controls the signing operation without requiring the private key to be distributed as an ordinary software file.
What is an HSM Code Signing Certificate?
It is a code signing certificate whose associated private key is protected using an HSM or qualifying hardware backed signing environment. HSM itself is not a certificate validation type.
Is an HSM a type of Code Signing Certificate?
No. HSM describes private key protection. Individual, organization validated, and extended validation describe certificate validation models.
Why does code signing use an HSM?
An HSM can provide a protected boundary for key generation, storage, activation, signing operations, access control, and auditing. It can also reduce the number of systems that can directly possess the signing private key.
What is the difference between an HSM and a hardware token?
A hardware token is generally designed for portable or workstation based key storage, while an HSM is designed for centralized cryptographic operations and enterprise key management. The exact capabilities depend on the product.
Can I use an OV Code Signing Certificate with an HSM?
Yes where the certificate authority supports the required HSM configuration. The certificate remains OV while the HSM protects its private key. SSL.com and GlobalSign currently document HSM based configurations for applicable OV certificates.
Can I use an EV Code Signing Certificate with an HSM?
Yes where the certificate authority supports the HSM configuration and required attestation. SSL.com, GlobalSign and DigiCert document HSM based EV signing configurations.
What FIPS level is required for code signing?
The exact requirement depends on the part of the architecture and the applicable CA requirements. Current CA/Browser Forum subscriber private key requirements reference at least FIPS 140-2 Level 2 or Common Criteria EAL4+ for qualifying HSM based protection, while signing service requirements have a higher cryptographic module requirement.
What is Common Criteria EAL4+?
Common Criteria Evaluation Assurance Level 4 plus is a security evaluation level referenced by some code signing key protection requirements. It is not interchangeable with a generic claim that an HSM is secure.
Can I use a cloud HSM for Code Signing?
Yes where the certificate authority supports the specific cloud HSM and its attestation or key verification process. SSL.com currently documents AWS CloudHSM, Azure Dedicated HSM, and Google Cloud HSM for supported code signing configurations.
Can I use AWS CloudHSM for Code Signing?
SSL.com currently documents AWS CloudHSM as a supported HSM for code signing certificate issuance, subject to its attestation process. Other certificate authorities should be checked individually.
Can I use Azure Key Vault HSM for Code Signing?
GlobalSign currently documents code signing certificate setup in Azure Key Vault with HSM protected private keys. Confirm the exact Azure service tier and current CA requirements before ordering.
Can I use Google Cloud HSM for Code Signing?
SSL.com currently documents Google Cloud HSM as a supported configuration for code signing certificate issuance, subject to attestation.
Can the private key be exported from an HSM?
Code signing architectures are designed to prevent unauthorized private key extraction. The exact export controls depend on the HSM and certificate authority requirements, and the private key should be generated and used within the approved protection boundary.
How does HSM Code Signing work with SignTool?
The HSM middleware exposes the protected certificate and key through a supported Windows cryptography interface such as CNG/KSP, CSP, or another vendor integration. SignTool then invokes the signing operation without receiving an ordinary exportable private key.
Can HSM Code Signing work with CI/CD?
Yes. The pipeline can submit a signing request through supported middleware, an API, a CLI, or a managed signing adapter while the private key remains inside the HSM environment.
Can HSM Code Signing be used for Java?
Yes where the HSM provider integrates with Java through a supported security provider or PKCS#11 interface. The JAR signing workflow still has to meet the requirements of the consuming Java ecosystem.
Can HSM Code Signing be used for Windows drivers?
HSM key protection can be part of a driver signing workflow, but the HSM does not replace Microsoft's driver signing and submission requirements. The certificate type and platform workflow must be verified separately.
How much does HSM Code Signing cost?
Total cost depends on the certificate, HSM or cloud HSM, attestation, managed signing, integration, operations, support, and usage. Certificate price alone is not a complete HSM signing cost.
Which Code Signing providers support HSMs?
DigiCert, GlobalSign, and SSL.com currently document HSM based code signing configurations. Sectigo and other providers should be checked against current HSM provisioning documentation before being represented as supported HSM providers.
What happens if the HSM fails?
The response depends on the HSM architecture and backup design. A production environment should define HSM replacement, key recovery where permitted, certificate continuity, and signing service recovery before a failure occurs.
What happens if the Code Signing private key is compromised?
Stop affected signing, investigate the scope, follow the CA's revocation process when required, generate a replacement key, obtain a replacement certificate, and review affected releases and the CI/CD environment.
What is the difference between HSM Code Signing and Cloud Code Signing?
HSM Code Signing focuses on private key protection through an HSM. Cloud Code Signing focuses on a cloud delivered signing service. A cloud signing service can itself use an HSM or cloud HSM.
What is the difference between HSM Code Signing and Remote Code Signing?
HSM describes the security boundary around the private key. Remote signing describes where the signing operation happens relative to the build system. A remote signing service can use an HSM.
Related HSM Code Signing Resources
Looking for HSM Based Code Signing?
Compare certificate requirements, HSM architectures, provider capabilities, CI/CD integrations, attestation, access controls, and total signing cost before choosing an HSM based signing environment.