Code Signing Key Management Server (CSKMS)

What Code Signing Key Management Server (CSKMS) is

Code Signing Key Management Server (CSKMS) is a self-hosted server that protects code-signing keys and signs firmware, applications, software images, block images, and hash fingerprints. It supports RSA, ECDSA, LMS, XMSS, and Dilithium signatures, signing either a supplied hash or a hash calculated from a presented file image. AES key management handles file encryption and key wrapping, while MAC-based authentication protects images. Code-signing clients connect through a RESTful API, with custom integration services available for backend over-the-air and provisioning systems. Administrators organize keys into groups, assign permissions, and use M-of-N hardware tokens. Keys are protected in FIPS 140-2 Level 3 hardware security modules. Logs record signatures, metadata, and users or applications using protected keys. Deployment can be offline in an isolated security bunker or through secure web services. WebAuthn remote tokens, certificate self-signing, CSR export, CI/CD signing, and Standard or Premium support are also listed.