SignServer

B tier on Code Signing SoftwareScore 7.2 · #3 of 26

Android app: Not listed
Free plan: Yes
Runs on: api, Linux, Mac, self-hosted, Web, Windows

signserver.org

Summary

SignServer is a server-side platform for managing signing keys and digitally signing code, documents, and timestamps. It supports multiple signing workflows in one installation, including container and firmware signing for IoT and DevOps uses. Teams can connect it to CI/CD pipelines, firmware build processes, document workflow engines, identity platforms, and other applications through standard interfaces. Community Edition is available as a Docker container, Helm chart, source code, or release from GitHub, and is also listed on SourceForge. Interfaces include SOAP, HTTP, REST, and the SignClient command-line tool, although Community REST does not include all endpoints. Community is free under LGPL V2.1 or later and is intended for learning, testing, and prototyping, not production. The maker says it lacks production capabilities such as audit, compliance, SLA, high availability, and security features. Enterprise offers professional support with an SLA, security updates, and maintenance. The maker recommends Hardware Security Modules for signing-key storage; secure-file storage is described as suitable only for testing and prototypes.

Who it is for

SignServer suits teams that need centrally managed signing across code, documents, containers, firmware, or timestamps. Community is aimed at learning, testing, and prototyping; production users may consider Enterprise.

What is good

Supports code, container, firmware, document, and timestamp signing.
Integrates with CI/CD and document workflows.
Community can be deployed as a container or Helm chart.
Supports HSM key protection and trusted timestamping.
Free Community edition.

What to know first

Community is not intended for production workloads.
Community lacks audit, compliance, SLA, and high availability capabilities.
Community REST does not include all endpoints.
Secure-file key storage is for testing and prototyping only.

Verdict

SignServer centralizes signing workflows and offers several deployment and integration routes. Community is explicitly limited to non-production use, so production needs call for assessing the Enterprise offering.

SignServer plans and pricing

All plans

SignServer Community Free Basic code, document, container signing and timestamping · source code or container deployment · intended for learning, testing, and prototyping signserver.org · 30 Sept 2026

SignServer Enterprise Cloud trial Free 30-day trial on AWS or Azure marketplaces Enterprise edition functionality · AWS or Azure cloud deployment signserver.org · 30 Sept 2026

Compared on code signing software

Free plan: Yessignserver.org
Supported targets: Windows PE executables, MSI, CAB, APPX/MSIX, PowerShell scripts, Java archives, Android APKs, Debian packages, Git commits, OpenPGP data, CMS/raw data, firmware, containers, documents, and ePassportssignserver.org
Cloud signing: Yessignserver.org
HSM key protection: Yessignserver.org
Trusted timestamping: Yessignserver.org
CI/CD signing: Yessignserver.org

Facts

Purpose: SignServer is a server-side platform for digitally signing code, documents, and timestamps.signserver.org · 30 Sept 2026
Centralized signing: It centrally stores and manages signing keys and supports multiple signing use cases in one installation.signserver.org · 30 Sept 2026
Signing use cases: The site lists code, container, firmware, document, and timestamp signing, including IoT and DevOps use cases.signserver.org · 30 Sept 2026
Automation: SignServer can integrate with CI/CD pipelines, firmware build processes, document workflow engines, identity platforms, and other business applications through standard interfaces.signserver.org · 30 Sept 2026
Deployment: Community can be downloaded as a Docker container, Helm chart, source code, or release from GitHub, and is also listed on SourceForge.signserver.org · 30 Sept 2026
Key protection: The maker recommends storing signing keys in a Hardware Security Module; secure-file storage is described as suitable only for testing and prototyping.signserver.org · 30 Sept 2026
Community production limit: Community Edition is not intended for production and lacks audit, compliance, SLA, high availability, and security capabilities needed for production workloads.signserver.org · 30 Sept 2026
Enterprise support: Enterprise offers professional support with an SLA, timely security updates, and maintenance.signserver.org · 30 Sept 2026
Interfaces: The edition comparison lists SOAP, HTTP, REST, and the SignClient command-line interface; Community REST support does not include all endpoints.signserver.org · 30 Sept 2026
Signing formats: The edition comparison lists code signing for CMS, OpenPGP, Debian, and Java in Community, with Microsoft and Android code signing listed for Enterprise and Cloud.signserver.org · 30 Sept 2026
Integrations: The comparison lists integration and secure automatic certificate renewal with CA/EJBCA, and the maker describes integration with third-party applications through standard interfaces.signserver.org · 30 Sept 2026
License: SignServer Community is released under LGPL V2.1 or later.signserver.org · 30 Sept 2026
Download verification: The maker recommends verifying downloads with SHA-512 hashes from GitHub or OpenPGP signatures from SignServer Keys.signserver.org · 30 Sept 2026
History: The first version of SignServer was released by PrimeKey in 2005, and the Enterprise edition was released in 2012.signserver.org · 30 Sept 2026