{"id":177,"date":"2026-06-10T00:00:00","date_gmt":"2026-06-10T00:00:00","guid":{"rendered":"https:\/\/codesigncert.com\/resourcesnew\/sign-an-azure-application-with-signtool-using-ksp-library\/"},"modified":"2026-08-02T09:04:51","modified_gmt":"2026-08-02T09:04:51","slug":"sign-an-azure-application-with-signtool-using-ksp-library","status":"publish","type":"resources","link":"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library","title":{"rendered":"How to Sign an Azure Application with SignTool Using KSP Library"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 ez-toc-wrap-right counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#What_Is_a_KSP_Library_and_Why_Does_It_Matter_for_Azure_App_Signing\" >What Is a KSP Library and Why Does It Matter for Azure App Signing?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Why_Signing_Azure_Applications_with_a_KSP_Library_Is_Now_a_Compliance_Requirement\" >Why Signing Azure Applications with a KSP Library Is Now a Compliance Requirement<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Prerequisites_What_You_Need_Before_You_Start\" >Prerequisites: What You Need Before You Start<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#How_to_Configure_NavSipdll_for_Azure_Application_Signing\" >How to Configure NavSip.dll for Azure Application Signing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Method_1_Sign_an_Azure_Application_Using_a_Certificate_File\" >Method 1: Sign an Azure Application Using a Certificate File<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Method_2_Sign_an_Azure_Application_Using_a_Certificate_Thumbprint\" >Method 2: Sign an Azure Application Using a Certificate Thumbprint<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Certificate_File_vs_Certificate_Thumbprint_Which_Method_Should_You_Use\" >Certificate File vs. Certificate Thumbprint: Which Method Should You Use?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#How_to_Verify_a_Signed_Azure_Application_with_SignTool\" >How to Verify a Signed Azure Application with SignTool<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Common_Errors_When_Signing_Azure_Apps_with_SignTool_and_KSP\" >Common Errors When Signing Azure Apps with SignTool and KSP<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Expert_Insight_Why_Cloud_KSP_Signing_Has_Replaced_USB_Token_Workflows_in_Enterprise_Azure_Pipelines\" >Expert Insight: Why Cloud KSP Signing Has Replaced USB Token Workflows in Enterprise Azure Pipelines<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Frequently_Asked_Questions\" >Frequently Asked Questions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"#\" data-href=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#Summary_Key_Takeaways\" >Summary: Key Takeaways<\/a><\/li><\/ul><\/nav><\/div>\n<div class=\"col-lg-12 mb-3 p-2\">\n<div class=\"content-container\">\n<p><!-- Introduction --><\/p>\n<section>Your Azure application build is complete. The installer is packaged, the pipeline has run, and it is ready for distribution. Then Windows Defender SmartScreen evaluates it \u2014 and presents the end user with an <a href=\"https:\/\/codesigncert.com\/blog\/how-to-fix-unknown-publisher-error\">&#8220;Unknown Publisher&#8221; warning<\/a> that stops the install cold. If you have been in cloud-native software delivery long enough, you know this moment. The fix is not complicated, but it must be done correctly, and in 2024 the standards for what &#8220;correctly&#8221; means changed significantly.To sign an Azure application with SignTool using a KSP library, you configure SignTool to route the signing operation through a cloud-based Key Storage Provider \u2014 such as DigiCert KeyLocker \u2014 so the private key never resides on your local machine or build agent. The result is a cryptographically valid, CA\/B Forum-compliant signature that satisfies both Windows trust requirements and enterprise security policy.<\/p>\n<p>I have been working at the intersection of Azure application delivery and code signing certificate infrastructure for over a decade. This guide covers the complete workflow: what a KSP library actually is, why this architecture is now mandatory, and both signing methods \u2014 certificate file and certificate thumbprint \u2014 with every command you need to execute them reliably in a production environment.<\/p>\n<\/section>\n<p><!-- Section: What Is a KSP Library --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"What_Is_a_KSP_Library_and_Why_Does_It_Matter_for_Azure_App_Signing\"><\/span>What Is a KSP Library and Why Does It Matter for Azure App Signing?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A KSP (Key Storage Provider) library is a Windows CryptoAPI Next Generation (CNG) plugin that allows SignTool and other signing tools to interface with external key stores \u2014 including cloud HSMs \u2014 rather than requiring the private key to reside locally on disk or a physical USB token.<\/p>\n<p>When SignTool executes a signing operation, it does not directly handle the private key. Instead, it asks the operating system&#8217;s CNG layer to perform the cryptographic operation. The KSP is the CNG plugin that handles that request \u2014 and if the KSP is configured to point at a cloud key store like DigiCert KeyLocker or Azure Key Vault, the signing operation is completed in the cloud. The private key never leaves the HSM boundary.<\/p>\n<p>For Azure application workflows, the two primary KSP options are <strong>DigiCert KeyLocker KSP<\/strong> and the <strong>Azure Key Vault CNG Provider<\/strong>. Both bridge SignTool to cloud-based key storage, but they differ in authentication model, latency characteristics, and suitability for CI\/CD pipelines. This guide focuses on DigiCert KeyLocker, which is the most widely deployed option for code signing certificate workflows.<\/p>\n<\/section>\n<p><!-- Section: Compliance Requirement --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Why_Signing_Azure_Applications_with_a_KSP_Library_Is_Now_a_Compliance_Requirement\"><\/span>Why Signing Azure Applications with a KSP Library Is Now a Compliance Requirement<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Since <strong>June 1, 2023<\/strong>, the CA\/Browser Forum Baseline Requirements (Section 16.3) mandate that all OV and EV code signing certificate private keys be stored on hardware meeting FIPS 140-2 Level 2 or equivalent standards \u2014 including cloud HSMs. Certificate Authorities can no longer issue code signing certificates where the private key is generated locally in software. This is not guidance; it is a hard issuance requirement.<\/p>\n<p>Beyond compliance, there are three practical reasons why cloud KSP signing is the right architecture for Azure application workflows:<\/p>\n<ul class=\"list-unstyled\">\n<li><strong>Private key security:<\/strong> A private key stored on a developer workstation or build server is a supply chain attack vector. Cloud HSMs with access control and audit logs eliminate that exposure entirely.<\/li>\n<li><strong>SmartScreen reputation:<\/strong> Unsigned or improperly signed applications trigger Microsoft Defender SmartScreen warnings that reduce user trust and suppress install conversion rates, particularly for ISVs distributing through web channels.<\/li>\n<li><strong>Pipeline scalability:<\/strong> KSP-based signing integrates directly into Azure DevOps pipelines and GitHub Actions without USB token dependencies or manual signing handoffs, which are the two most common failure points in enterprise signing workflows.<\/li>\n<li><strong>Timestamp validity:<\/strong> Signatures produced through a trusted KSP and timestamped against an RFC 3161 server remain cryptographically valid after the signing certificate expires \u2014 critical for long-lived software artifacts.<\/li>\n<\/ul>\n<\/section>\n<p><!-- Section: Prerequisites --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Prerequisites_What_You_Need_Before_You_Start\"><\/span>Prerequisites: What You Need Before You Start<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Before executing any signing command, confirm that all of the following are in place. Missing a single prerequisite \u2014 particularly the KSP registration \u2014 is the most common reason SignTool fails silently or returns a CNG provider error.<\/p>\n<ul>\n<li><strong>Windows operating system:<\/strong> Windows 10\/11 or Windows Server 2019\/2022<\/li>\n<li><strong>SignTool installed:<\/strong> via the Windows SDK \u2014 confirm with <code>signtool.exe \/?<\/code> from an elevated command prompt<\/li>\n<li><strong>DigiCert KeyLocker client:<\/strong> installed and authenticated \u2014 the <code>smctl<\/code> binary must be in your system PATH<\/li>\n<li><strong>Keypair alias:<\/strong> the identifier for your private key in KeyLocker (found in your KeyLocker dashboard)<\/li>\n<li><strong>Certificate file or certificate fingerprint:<\/strong> you will use one or the other depending on your signing method<\/li>\n<li><strong>NavSip.dll registered:<\/strong> required for specific Azure and NAV file types; covered in the next section<\/li>\n<li><strong>Active OV or <a href=\"https:\/\/codesigncert.com\/ev-code-signing-certificates\">EV code signing certificate<\/a>:<\/strong> issued with cloud HSM key storage<\/li>\n<\/ul>\n<\/section>\n<p><!-- Section: NavSip.dll Configuration --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"How_to_Configure_NavSipdll_for_Azure_Application_Signing\"><\/span>How to Configure NavSip.dll for Azure Application Signing<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Certain file types \u2014 including <strong>.app<\/strong> and <strong>.fob<\/strong> files common in Azure-connected NAV deployments \u2014 require a Signature Interface Package (SIP) library to be registered before SignTool can process them. The SIP library that handles these types is <strong>NavSip.dll<\/strong>, distributed with Microsoft Dynamics NAV 2018.<\/p>\n<p>If this step is skipped for applicable file types, SignTool returns a SIP-layer error rather than a meaningful signing failure message, which makes it difficult to diagnose. Register NavSip.dll before attempting to sign:<\/p>\n<ol>\n<li>Download Microsoft Dynamics NAV 2018 from the Microsoft Volume Licensing Service Center or MSDN.<\/li>\n<li>Extract the package to a local directory.<\/li>\n<li>Locate NavSip.dll at: <code>Dynamics.110.NA.2468045.DVDServiceTierSystem64Folder<\/code><\/li>\n<li>Copy NavSip.dll to <code>C:WindowsSystem32<\/code><\/li>\n<li>Register the DLL by running the following from an elevated command prompt:<\/li>\n<\/ol>\n<pre><code>regsvr32.exe C:WindowsSystem32navsip.dll<\/code><\/pre>\n<div class=\"alert alert-info\" role=\"alert\"><strong>Note:<\/strong> If you are signing standard .exe, .dll, or .msi files only, you can skip NavSip.dll registration. It is required specifically for NAV\/Azure file types that use a non-standard SIP.<\/div>\n<\/section>\n<p><!-- Section: Method 1 --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Method_1_Sign_an_Azure_Application_Using_a_Certificate_File\"><\/span>Method 1: Sign an Azure Application Using a Certificate File<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This method references the certificate directly from a .crt or .cer file on disk. It is the simpler of the two methods and is appropriate for individual signing operations or workflows where the certificate file path is known and static.<\/p>\n<h3>SignTool Command for Azure App Signing via Certificate File<\/h3>\n<pre><code>signtool.exe sign \/csp \"DigiCert Signing Manager KSP\" \/kc &lt;keypair_alias&gt; \/f &lt;certificate_file&gt; \/tr http:\/\/timestamp.digicert.com \/td SHA256 \/fd SHA256 &lt;file_to_be_signed&gt;<\/code><\/pre>\n<h3>Example<\/h3>\n<pre><code>signtool.exe sign \/csp \"DigiCert Signing Manager KSP\" \/kc myapp-key-1 \/f codesign.crt \/tr http:\/\/timestamp.digicert.com \/td SHA256 \/fd SHA256 AzureApp.exe<\/code><\/pre>\n<h3>Key Parameters Explained<\/h3>\n<div class=\"table-responsive\">\n<table class=\"table table-striped\">\n<thead>\n<tr>\n<th>Parameter<\/th>\n<th>Purpose<\/th>\n<th>Required<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>\/csp<\/code><\/td>\n<td>Specifies the KSP provider name \u2014 must match exactly as registered<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td><code>\/kc<\/code><\/td>\n<td>Keypair alias \u2014 identifies the private key in DigiCert KeyLocker<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td><code>\/f<\/code><\/td>\n<td>Path to the certificate file (.crt or .cer)<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td><code>\/tr<\/code><\/td>\n<td>RFC 3161 timestamp server URL \u2014 ensures long-term signature validity<\/td>\n<td>Yes (recommended)<\/td>\n<\/tr>\n<tr>\n<td><code>\/fd<\/code><\/td>\n<td>File digest algorithm \u2014 SHA256 is the current standard; SHA1 is deprecated<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td><code>\/td<\/code><\/td>\n<td>Timestamp digest algorithm \u2014 must match \/fd in modern signing workflows<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div class=\"alert alert-info\" role=\"alert\"><strong>Important:<\/strong> Always include <code>\/tr<\/code> and <code>\/td<\/code> in every signing command. A signature without a timestamp becomes invalid the moment the signing certificate expires. This is the single most common oversight in automated signing pipelines.<\/div>\n<\/section>\n<p><!-- Section: Method 2 --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Method_2_Sign_an_Azure_Application_Using_a_Certificate_Thumbprint\"><\/span>Method 2: Sign an Azure Application Using a Certificate Thumbprint<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This method reads the signing certificate from the Windows Certificate Store rather than from a file path. It is better suited to CI\/CD pipelines and automated environments where certificate file paths may vary across agents, or where the certificate is centrally managed through the Windows store.<\/p>\n<h3>Step 1 \u2014 Sync Certificate to Windows Certificate Store<\/h3>\n<p>Before SignTool can locate the certificate by thumbprint, it must be present in the local Windows Certificate Store. Use the DigiCert <code>smctl<\/code> utility to sync it:<\/p>\n<pre><code>smctl windows certsync --keypair-alias=&lt;keypair_alias&gt;<\/code><\/pre>\n<p>This command fetches the certificate associated with the specified keypair alias from DigiCert KeyLocker and imports it into the Current User certificate store. Run this step on every new build agent before executing the signing command.<\/p>\n<h3>Step 2 \u2014 Retrieve the Certificate Thumbprint via PowerShell<\/h3>\n<pre><code>$cert = Get-ChildItem Cert:CurrentUserMy | Where-Object {$_.FriendlyName -like \"&lt;CERTIFICATE_ALIAS&gt;\"}\r\n$thumbprint = $cert.Thumbprint\r\nWrite-Host($thumbprint)<\/code><\/pre>\n<p>The <code>-like<\/code> filter matches on the certificate&#8217;s friendly name, which corresponds to the keypair alias used during certsync. Copy the returned thumbprint \u2014 it will be a 40-character hexadecimal string.<\/p>\n<h3>Step 3 \u2014 Sign Using the Certificate Thumbprint<\/h3>\n<pre><code>signtool.exe sign \/sha1 &lt;certificate_thumbprint&gt; \/tr http:\/\/timestamp.digicert.com \/td SHA256 \/fd SHA256 &lt;file_to_be_signed&gt;<\/code><\/pre>\n<h3>Example<\/h3>\n<pre><code>signtool.exe sign \/sha1 3550ffca3cd652dde30675ce681ea1e01073e647 \/tr http:\/\/timestamp.digicert.com \/td SHA256 \/fd SHA256 AzureApp.exe<\/code><\/pre>\n<div class=\"alert alert-info\" role=\"alert\"><strong>Common Misunderstanding:<\/strong> The <code>\/sha1<\/code> flag in this command does NOT specify SHA1 as the hashing algorithm. It is a certificate lookup parameter \u2014 it tells SignTool to find the certificate in the Windows store by its SHA1 thumbprint identifier. The actual signing hash is controlled by <code>\/fd SHA256<\/code>. This distinction matters because many engineers mistakenly avoid this method thinking it produces a SHA1-signed artifact.<\/div>\n<\/section>\n<p><!-- Section: Method Comparison --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Certificate_File_vs_Certificate_Thumbprint_Which_Method_Should_You_Use\"><\/span>Certificate File vs. Certificate Thumbprint: Which Method Should You Use?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Both methods produce cryptographically identical signatures. The choice between them is entirely operational, based on your deployment environment and workflow architecture.<\/p>\n<div class=\"table-responsive\">\n<table class=\"table table-striped\">\n<thead>\n<tr>\n<th>Criteria<\/th>\n<th>Method 1: Certificate File<\/th>\n<th>Method 2: Certificate Thumbprint<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Setup complexity<\/td>\n<td>Lower \u2014 only requires a .crt file<\/td>\n<td>Higher \u2014 requires certsync step first<\/td>\n<\/tr>\n<tr>\n<td>Best use case<\/td>\n<td>One-off signing, local developer workflow<\/td>\n<td>CI\/CD pipelines, shared build agents<\/td>\n<\/tr>\n<tr>\n<td>Pipeline automation<\/td>\n<td>Requires stable file path across agents<\/td>\n<td>Works without file path dependencies<\/td>\n<\/tr>\n<tr>\n<td>Windows Store dependency<\/td>\n<td>None<\/td>\n<td>Certificate must be synced to store<\/td>\n<\/tr>\n<tr>\n<td>Signature output<\/td>\n<td>Identical to Method 2<\/td>\n<td>Identical to Method 1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>For teams running Azure DevOps pipelines with multiple hosted agents, Method 2 is the more robust choice. The certsync step can be added as the first task in the signing stage, ensuring the certificate is always present regardless of which agent picks up the job.<\/p>\n<\/section>\n<p><!-- Section: Verification --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"How_to_Verify_a_Signed_Azure_Application_with_SignTool\"><\/span>How to Verify a Signed Azure Application with SignTool<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Verification is not optional. A signing command that completes without error does not guarantee a valid signature \u2014 timestamp server timeouts, chain issues, and test certificate states can all produce a technically completed signing operation that fails verification. Always run verification as a post-signing step.<\/p>\n<pre><code>signtool verify \/v \/pa &lt;signed_file&gt;<\/code><\/pre>\n<h3>Example<\/h3>\n<pre><code>signtool verify \/v \/pa AzureApp.exe<\/code><\/pre>\n<p>A successful verification output will include:<\/p>\n<ul>\n<li>Successfully verified: &lt;file_path&gt;<\/li>\n<li>Signing Certificate Chain confirmation<\/li>\n<li>The signature timestamp<\/li>\n<li>Hash of file (sha256)<\/li>\n<\/ul>\n<p><strong>Common verification errors and what they indicate:<\/strong><\/p>\n<div class=\"table-responsive\">\n<table class=\"table table-striped\">\n<thead>\n<tr>\n<th>Error Code<\/th>\n<th>Meaning<\/th>\n<th>Resolution<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>TRUST_E_NOSIGNATURE<\/code><\/td>\n<td>No signature found on the file<\/td>\n<td>Signing command did not complete \u2014 re-run with verbose output (\/debug)<\/td>\n<\/tr>\n<tr>\n<td><code>CERT_E_UNTRUSTEDROOT<\/code><\/td>\n<td>Certificate chain does not lead to a trusted root<\/td>\n<td>Expected with test\/self-signed certs; not an issue with CA-issued certs in production<\/td>\n<\/tr>\n<tr>\n<td><code>CERT_E_EXPIRED<\/code><\/td>\n<td>Certificate has expired and no timestamp was applied<\/td>\n<td>Re-sign with a valid certificate and include \/tr timestamp flag<\/td>\n<\/tr>\n<tr>\n<td><code>0x800B0003<\/code><\/td>\n<td>Unknown SIP error \u2014 NavSip.dll likely not registered<\/td>\n<td>Register NavSip.dll using regsvr32.exe as described in the prerequisites section<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/section>\n<p><!-- Section: Common Errors --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Common_Errors_When_Signing_Azure_Apps_with_SignTool_and_KSP\"><\/span>Common Errors When Signing Azure Apps with SignTool and KSP<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>After ten years of working with code signing infrastructure, these are the six errors I see most frequently in Azure signing workflows. Each one has a predictable cause and a straightforward fix.<\/p>\n<ol>\n<li><strong>KSP provider not recognized<\/strong> \u2014 SignTool returns &#8220;No certificates were found that meet all the given criteria.&#8221; The DigiCert KeyLocker client service is either not installed, not running, or the \/csp value does not exactly match the registered KSP name. Confirm the service is running (<code>smctl healthcheck<\/code>) and that the \/csp value is &#8220;DigiCert Signing Manager KSP&#8221; verbatim, including capitalization.<\/li>\n<li><strong>NavSip.dll not registered<\/strong> \u2014 SignTool completes without error but verification fails with a SIP-layer error (0x800B0003). This happens when signing .app or .fob files without registering NavSip.dll. Register it using regsvr32.exe as described in the prerequisites section.<\/li>\n<li><strong>\/sha1 flag misidentified as SHA1 algorithm<\/strong> \u2014 Engineers avoid Method 2 because they believe \/sha1 produces a weak SHA1 signature. It does not. The \/sha1 flag is a certificate lookup mechanism \u2014 it tells SignTool which certificate to use from the Windows store. The hash algorithm is set by <code>\/fd SHA256<\/code>.<\/li>\n<li><strong>Timestamp server omitted<\/strong> \u2014 The signing command succeeds, the file appears signed, but the signature expires with the certificate. Any application signed without \/tr will generate trust warnings after certificate expiry. Include <code>\/tr http:\/\/timestamp.digicert.com \/td SHA256<\/code> in every signing command without exception.<\/li>\n<li><strong>Certificate not synced to Windows store (Method 2)<\/strong> \u2014 SignTool returns &#8220;No certificates were found&#8221; when using the thumbprint method. The certificate has not been imported into the local store. Run <code>smctl windows certsync --keypair-alias=&lt;alias&gt;<\/code> before executing the sign command. In pipeline environments, add this as the first step in every signing job.<\/li>\n<li><strong>Wrong keypair alias<\/strong> \u2014 The KSP cannot locate the private key and returns a CNG provider error. Keypair alias values are case-sensitive in DigiCert KeyLocker. Confirm the exact alias from the KeyLocker dashboard and use it verbatim in both the \/kc flag (Method 1) and the certsync command (Method 2).<\/li>\n<\/ol>\n<\/section>\n<p><!-- Section: Expert Insight --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Expert_Insight_Why_Cloud_KSP_Signing_Has_Replaced_USB_Token_Workflows_in_Enterprise_Azure_Pipelines\"><\/span>Expert Insight: Why Cloud KSP Signing Has Replaced USB Token Workflows in Enterprise Azure Pipelines<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The shift from USB token-based code signing to cloud KSP architecture is often framed as a compliance response to the CA\/B Forum&#8217;s 2023 HSM mandate. That framing is technically accurate but misses the more important operational story.<\/p>\n<p>USB token signing had a fundamental architectural problem in CI\/CD environments: a physical token cannot be present on a cloud-hosted build agent. Teams worked around this with self-hosted agents that had tokens physically attached, or with complex token-sharing infrastructure. Both approaches created signing bottlenecks \u2014 a single physical token became a serialization point in a parallel build system. A pipeline waiting for token availability is a pipeline not scaling.<\/p>\n<p>Cloud KSP removes that constraint entirely. Because the key storage is a cloud service endpoint, any authenticated build agent can perform a signing operation simultaneously, with no contention on physical hardware. For ISVs who sign thousands of artifacts per release cycle \u2014 installers, drivers, manifests, update packages \u2014 this is not a minor efficiency gain. It is an architectural prerequisite for modern release velocity.<\/p>\n<p>There is also a subtler benefit: teams that integrate KSP signing into their pipeline definition files rather than post-build scripts reduce signing failures by removing manual handoff steps. When signing is a pipeline stage \u2014 not a developer task that happens after the pipeline \u2014 the audit trail is complete, the signing key access is logged, and certificate rotation does not require developer action.<\/p>\n<div class=\"alert alert-info\" role=\"alert\"><strong>Security Note:<\/strong> According to NIST Special Publication 800-57 Part 1, private keys used in production signing workflows should be stored in hardware-validated key storage at FIPS 140-2 Level 2 or higher. Cloud HSMs including DigiCert KeyLocker and Azure Key Vault Premium meet this standard. Local software-based key storage does not.<\/div>\n<\/section>\n<p><!-- Section: FAQ --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3>What is the difference between KSP and CSP in code signing?<\/h3>\n<p>A CSP (Cryptographic Service Provider) uses the legacy Windows CryptoAPI (CAPI) interface, which has been in place since Windows XP. A KSP (Key Storage Provider) uses the modern CNG (Cryptographic API: Next Generation) interface, introduced in Windows Vista. SignTool supports both, but KSP is required for cloud-based key stores, ECC key algorithms, and any key storage that needs to meet FIPS 140-2 Level 2 compliance. For all new Azure signing workflows, KSP is the correct choice.<\/p>\n<h3>Can I use Azure Key Vault instead of DigiCert KeyLocker as a KSP for SignTool?<\/h3>\n<p>Yes. Azure Key Vault can be used as a KSP through the Azure Key Vault CNG Provider plugin (available on GitHub). The SignTool command structure is similar \u2014 you specify the AKV provider in the \/csp parameter and the key identifier in \/kc \u2014 but authentication uses Azure service principal credentials rather than DigiCert KeyLocker API tokens. The choice between the two typically depends on whether your code signing certificates are issued through DigiCert (where KeyLocker is the natural fit) or whether you are managing certificates entirely within the Azure ecosystem.<\/p>\n<h3>Why does my SignTool command fail with &#8220;No certificates were found&#8221; when using the thumbprint method?<\/h3>\n<p>The certificate has not been synced to the local Windows certificate store. This is the most common cause of this error in pipeline environments. Run <code>smctl windows certsync --keypair-alias=&lt;alias&gt;<\/code> before executing the sign command. In Azure DevOps or GitHub Actions pipelines, add this command as the first task in the signing stage so that it runs on every agent before any signing operation executes.<\/p>\n<h3>Does signing with a cloud KSP slow down my build pipeline?<\/h3>\n<p>There is a network latency overhead per signing operation, typically one to three seconds for standard file types. For most builds, this is negligible. For pipelines signing hundreds or thousands of artifacts in a single release, DigiCert KeyLocker supports batch signing via the <code>smctl sign<\/code> command with directory-level wildcards, which reduces cumulative latency by minimizing the number of authentication round-trips. Structure batch signing jobs to group artifacts by directory rather than calling SignTool individually per file.<\/p>\n<h3>Is a timestamp required when signing Azure applications?<\/h3>\n<p>Yes, if long-term validity matters \u2014 and it always does in production deployments. Without a timestamp, the digital signature is valid only for the duration of the signing certificate. Once the certificate expires, the signature is treated as unverified by Windows trust evaluation. Timestamping embeds an RFC 3161 countersignature from a trusted Timestamp Authority (TSA) that is independent of the signing certificate&#8217;s validity period. Use <code>\/tr http:\/\/timestamp.digicert.com \/td SHA256<\/code> in every signing command.<\/p>\n<\/section>\n<p><!-- Section: Summary --><\/p>\n<section>\n<h2><span class=\"ez-toc-section\" id=\"Summary_Key_Takeaways\"><\/span>Summary: Key Takeaways<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>For quick reference, here is what every IT administrator, ISV, and Azure engineer needs to remember about this workflow:<\/p>\n<ul>\n<li>A KSP library routes SignTool signing operations through a cloud HSM, keeping the private key off local machines and in compliance with CA\/B Forum Baseline Requirements.<\/li>\n<li>Two signing methods are available: certificate file (simpler, better for local\/one-off signing) and certificate thumbprint (more robust for CI\/CD pipelines and shared build agents).<\/li>\n<li>NavSip.dll registration is required for Azure NAV file types (.app, .fob) and must be completed before signing; it is not needed for standard .exe, .dll, or .msi files.<\/li>\n<li>SHA256 is mandatory for both the file digest (<code>\/fd SHA256<\/code>) and the timestamp digest (<code>\/td SHA256<\/code>). The <code>\/sha1<\/code> flag in Method 2 is a certificate lookup mechanism, not a hash algorithm selector.<\/li>\n<li>Always verify signatures after signing using <code>signtool verify \/v \/pa<\/code> \u2014 a completed signing command is not the same as a valid signature.<\/li>\n<li>Timestamp every signed artifact with <code>\/tr<\/code> and <code>\/td<\/code> to preserve signature validity beyond certificate expiry.<\/li>\n<li>In pipeline environments, run <code>smctl windows certsync<\/code> before every signing job to ensure the certificate is present in the Windows store.<\/li>\n<\/ul>\n<p>If you need a code signing certificate compatible with cloud KSP workflows and Azure DevOps pipelines, Azure Key Vault code signing certificates provide the cloud HSM key storage required for both compliance and operational scalability. Both OV and EV options are available with DigiCert KeyLocker key storage, ready to integrate into the workflow described above.<\/p>\n<\/section>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Your Azure application build is complete. The installer is packaged, the pipeline has run, and it is ready for distribution. Then Windows Defender SmartScreen evaluates it \ufffd and presents the end user with an &#8220;Unknown Publisher&#8221; warning that stops the install cold. If you have been in cloud-native software delivery long enough, you know this moment. The fix is not complicated, but it must be done correctly, and in 2024 the standards for what &#8220;correctly&#8221; means changed significantly.<\/p>\n","protected":false},"featured_media":0,"template":"","meta":[],"resources_category":[50],"class_list":["post-177","resources","type-resources","status-publish","hentry","resources_category-code-signing-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Sign an Azure Application with SignTool Using KSP Library<\/title>\n<meta name=\"description\" content=\"Sign an Azure application with SignTool using a KSP library via certificate file or thumbprint. Secure cloud key storage with DigiCert KeyLocker. Full setup guide.\" \/>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Sign an Azure Application with SignTool Using KSP Library\" \/>\n<meta property=\"og:description\" content=\"Sign an Azure application with SignTool using a KSP library via certificate file or thumbprint. Secure cloud key storage with DigiCert KeyLocker. Full setup guide.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/\" \/>\n<meta property=\"og:site_name\" content=\"CodeSignCert\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/codesigncert\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-02T09:04:51+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@codesigncert\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/codesigncert.com\\\/resources\\\/sign-an-azure-application-with-signtool-using-ksp-library\\\/\",\"url\":\"https:\\\/\\\/codesigncert.com\\\/resources\\\/sign-an-azure-application-with-signtool-using-ksp-library\\\/\",\"name\":\"How to Sign an Azure Application with SignTool Using KSP Library\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/codesigncert.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-06-10T00:00:00+00:00\",\"dateModified\":\"2026-08-02T09:04:51+00:00\",\"description\":\"Sign an Azure application with SignTool using a KSP library via certificate file or thumbprint. Secure cloud key storage with DigiCert KeyLocker. Full setup guide.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/codesigncert.com\\\/resources\\\/sign-an-azure-application-with-signtool-using-ksp-library\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/codesigncert.com\\\/resources\\\/sign-an-azure-application-with-signtool-using-ksp-library\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/codesigncert.com\\\/resources\\\/sign-an-azure-application-with-signtool-using-ksp-library\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/codesigncert.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Resources\",\"item\":\"https:\\\/\\\/codesigncert.com\\\/?post_type=resources\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How to Sign an Azure Application with SignTool Using KSP Library\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/codesigncert.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/codesigncert.com\\\/blog\\\/\",\"name\":\"CodeSignCert\",\"description\":\"All in One Code Signing Certificate Store\",\"alternateName\":\"Code Sign Cert\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/codesigncert.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Sign an Azure Application with SignTool Using KSP Library","description":"Sign an Azure application with SignTool using a KSP library via certificate file or thumbprint. Secure cloud key storage with DigiCert KeyLocker. Full setup guide.","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"How to Sign an Azure Application with SignTool Using KSP Library","og_description":"Sign an Azure application with SignTool using a KSP library via certificate file or thumbprint. Secure cloud key storage with DigiCert KeyLocker. Full setup guide.","og_url":"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/","og_site_name":"CodeSignCert","article_publisher":"https:\/\/www.facebook.com\/codesigncert","article_modified_time":"2026-08-02T09:04:51+00:00","twitter_card":"summary_large_image","twitter_site":"@codesigncert","twitter_misc":{"Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/","url":"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/","name":"How to Sign an Azure Application with SignTool Using KSP Library","isPartOf":{"@id":"https:\/\/codesigncert.com\/blog\/#website"},"datePublished":"2026-06-10T00:00:00+00:00","dateModified":"2026-08-02T09:04:51+00:00","description":"Sign an Azure application with SignTool using a KSP library via certificate file or thumbprint. Secure cloud key storage with DigiCert KeyLocker. Full setup guide.","breadcrumb":{"@id":"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/codesigncert.com\/resources\/sign-an-azure-application-with-signtool-using-ksp-library\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/codesigncert.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Resources","item":"https:\/\/codesigncert.com\/?post_type=resources"},{"@type":"ListItem","position":3,"name":"How to Sign an Azure Application with SignTool Using KSP Library"}]},{"@type":"WebSite","@id":"https:\/\/codesigncert.com\/blog\/#website","url":"https:\/\/codesigncert.com\/blog\/","name":"CodeSignCert","description":"All in One Code Signing Certificate Store","alternateName":"Code Sign Cert","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/codesigncert.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/codesigncert.com\/blog\/wp-json\/wp\/v2\/resources\/177","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/codesigncert.com\/blog\/wp-json\/wp\/v2\/resources"}],"about":[{"href":"https:\/\/codesigncert.com\/blog\/wp-json\/wp\/v2\/types\/resources"}],"wp:attachment":[{"href":"https:\/\/codesigncert.com\/blog\/wp-json\/wp\/v2\/media?parent=177"}],"wp:term":[{"taxonomy":"resources_category","embeddable":true,"href":"https:\/\/codesigncert.com\/blog\/wp-json\/wp\/v2\/resources_category?post=177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}