> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Sign with DigiCert > Issue code-signing certificates from DigiCert CertCentral with an HSM-backed key. ## Concept A DigiCert Certificate Authority configured for code signing issues OV (`code_signing`) and EV (`code_signing_ev`) certificates from your CertCentral account against a CSR. The signing key must live on an HSM, so Infisical generates the CSR against an HSM key and sends only the CSR to DigiCert. This guide covers using such a CA from the **Code Signing** product. To set up the CA itself, see [DigiCert (CertCentral Services API)](https://infisical.com/docs/documentation/platform/pki/ca/digicert-direct.md). ## Prerequisites * A DigiCert Certificate Authority created with **Purpose** set to `Code Signing`. See [DigiCert (CertCentral Services API)](https://infisical.com/docs/documentation/platform/pki/ca/digicert-direct.md). * An [HSM Connector](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors) the signing key can be generated on. ## Create a signer Once a CA is configured for code signing, it appears in the **Code Signing → Create Signer** wizard's CA picker. The Signer is created in **Pending** state while DigiCert processes the order, and flips to **Active** once the certificate issues. DigiCert's code-signing workflow includes an out-of-band approval step that the API can't skip: DigiCert emails an approval link to the order's approver, and the order stays **Pending** until someone opens that link and approves it in DigiCert. Depending on your CertCentral account's settings this can apply per order, so a Signer can sit in Pending even after the organization is validated. > [!NOTE] > > Code-signing certificates require an HSM-backed key. When you select a DigiCert code-signing CA, the Signer wizard locks the key source to **HSM** and you must pick an [HSM Connector](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors). A **Pending** signer is checked on a schedule. To poll DigiCert immediately, use **Check issuance now** from the signer's actions menu. Hovering the **Pending** status on the signer's detail page shows the DigiCert **order number** so you can open that order in DigiCert to approve it or resend the approval email. ### Use an existing order Each DigiCert order consumes a subscription slot on your CertCentral account. If a code-signing order already exists in this CA's organization and product, a Signer can use that order instead of placing a new one. This works for orders placed directly in DigiCert too. The Common Name and Validity come from the order. When you pick an order, the **Use existing key** toggle decides what happens to its certificate: * On: the Signer uses the order's issued certificate and its existing private key, and nothing is reissued * Off: DigiCert reissues the certificate in the order and revokes the previous certificate #### Use existing key Use this option to bring certificates you already have into Infisical. The certificate stays valid wherever else it's in use. The certificate and its key need to meet these requirements: * The order's certificate is issued and hasn't expired * The certificate's private key is in the slot of one of your [HSM Connectors](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors) * The key is RSA-3072, RSA-4096, ECDSA P-256, or ECDSA P-384 If the key doesn't match the certificate, the request fails and nothing changes. > [tab] Infisical UI > > **Step 1** > > In the Create Signer wizard's **Certificate** step, select the order in **Existing order**. > > **Step 2** > > In the **Signing Key** step, select the **HSM Connector**, turn on **Use existing key**, and enter the label of the certificate's private key in **Key label**. If more than one key in the slot has that label, select the key in **Key ID**. > > To switch an existing signer to the certificate, follow the same steps in **Edit Signer**. > [tab] API > > To create a signer that uses the certificate, call [the endpoint that creates a signer](https://infisical.com/docs/api-reference/endpoints/code-signing/signers/create.md) with `externalConfiguration.importFromExternalOrderId` set to the order ID and `certificate.hsmKeyLabel` set to the key's label. If more than one private key in the slot has that label, also set `certificate.hsmKeyId` to the key's hex-encoded `CKA_ID`: > > ```json theme={"dark"} > { > "certificate": { > "keySource": "hsm", > "hsmConnectorId": "", > "hsmKeyLabel": "", > "hsmKeyId": "" > }, > "externalConfiguration": { > "importFromExternalOrderId": "" > } > } > ``` > > To switch an existing signer to the certificate, call [the endpoint that imports a certificate into a signer](https://infisical.com/docs/api-reference/endpoints/code-signing/signers/import-certificate.md) with the order ID in `externalOrderId` and the same `certificate` fields, without `keySource`. To renew the certificate with the same HSM key before it expires, set **Renew before**. #### Reissue the certificate > [tab] Infisical UI > > In the Create Signer wizard's **Certificate** step, select the order in **Existing order**. In the **Signing Key** step, leave **Use existing key** off. Leave **Existing order** empty to place a new order. > [tab] API > > Set `externalConfiguration.reissueFromExternalOrderId` to the order ID on [Create Signer](https://infisical.com/docs/api-reference/endpoints/code-signing/signers/create.md) or [Reissue](https://infisical.com/docs/api-reference/endpoints/code-signing/signers/reissue-certificate.md). > [!WARNING] > > Reissuing into an existing order replaces that order's certificate. DigiCert revokes the previous certificate within 72 hours, after which it can no longer be used to sign. ## Editing a signer Editing a signer's Common Name, validity, key source, key algorithm, or CA triggers a fresh issuance. The signer returns to **Pending** until the new certificate issues, and DigiCert revokes the previous certificate within 72 hours. If you switch the signer to an order's [issued certificate](#use-existing-key), nothing is issued and the signer uses that certificate right away. ## Reissue and renewal * **Reissue** (changing the key source, key algorithm, or reissuing into an existing order) hits DigiCert's reissue endpoint, which keeps the same order and its validity and replaces the certificate. * **Auto-renewal** (when **Renew before** is set) places a new order linked to the prior one so DigiCert tracks certificate history. If DigiCert reports the prior order as not eligible for renewal, Infisical falls back to a fresh, unlinked order. ## Deleting a signer Deleting a DigiCert code-signing signer revokes its DigiCert order, so the certificate can no longer be used to sign anywhere. Depending on your CertCentral account's revocation policy, DigiCert may queue the revocation for administrator approval. ## Next steps Once your signer is **Active**, you can use it to sign artifacts through the Infisical [PKCS#11 module](https://infisical.com/docs/documentation/platform/pki/code-signing/pkcs11-module.md). The signing workflow is the same as any other Infisical signer—only the certificate backing it comes from DigiCert. > [card] [Sign Windows Executables](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/osslsigncode.md) > > Sign `.exe`, `.dll`, `.msi`, and other Windows artifacts with osslsigncode > [card] [Sign Java JARs](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/jarsigner.md) > > Sign Java archives with jarsigner > [card] [Sign Container Images](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/cosign.md) > > Sign OCI container images with Sigstore cosign > [card] [Sign with OpenSSL](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/openssl.md) > > General-purpose signing with OpenSSL This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.