The sign command allows you to sign one or more files using a certificate stored on the Signotaur server. It supports advanced options such as timestamping, verifying signatures, and fallback timestamp servers for reliability. It can handle multiple files efficiently with wildcard support.
SignotaurTool.exe sign [options] <files>
A list of file paths to sign. You can specify individual file paths or use wildcards to match multiple files. This parameter supports the following wildcard patterns:
*: Matches zero or more characters within a file name. For example, *.exe will match all executable files in the specified directory.?: Matches a single character. For instance, file?.dll will match file1.dll, file2.dll, but not file12.dll.**: Indicates a recursive search across all subdirectories. For example, **/*.exe will match all .exe files found in the current directory and all its subdirectories.Examples:
*.exe: Matches all executable files in the specified directory.C:\Projects\**\*.dll: Matches all dynamic link library files in the C:\Projects directory and any of its subdirectories.C:\MyFiles\file?.exe: Matches any executable files that start with "file" followed by a single character.Notes:
--file-list option to specify the path to a file containing the list of file paths.-a, --api-key <APIKey>
Required. Specifies the Signotaur API key needed to authenticate with the Signotaur service.
-s, --sign-server <URL>
Required. Specifies the URL of the Signotaur server that will handle the signing operation.
-t, --thumbprint <Thumbprint>
Specifies the certificate thumbprint to be used for signing. You can obtain this thumbprint from the Signotaur certificate page. Either a thumbprint or subject is required to identify the signing certificate.
--sb, --subject <Subject>
Specifies the certificate subject. Either subject or thumbprint is required to identify the signing certificate.
--ac, --additional-certs <CertList>
Adds additional certificates from file paths to the signature block. You can provide a comma-separated list of certificate file paths. This is useful for including intermediate or root certificates that may be necessary for validation.
-d, --description <Description>
Specifies a description of the signed content. This description will be embedded in the signature and should provide context about the content being signed.
--du, --description-url <URL>
Specifies a URL for an expanded description of the signed content. This URL can point to a webpage or document that provides more detailed information about the signed files.
--an, --app-name <Name>
Specifies an application name - only used when signing ClickOnce/VSTO manifests.
--fd, --file-digest <Algorithm>
Required. Specifies the file digest algorithm to use for creating file signatures. Supported algorithms include: SHA256, SHA384, SHA512.
--ph, --page-hashing
Enables the generation of page hashes for executable files if supported by the file type. This is useful for ensuring the integrity of the executable's pages and can help detect tampering.
--nph, --no-page-hashing
Suppresses the generation of page hashes for executable files if supported. Use this option if you do not want to include page hashes in the signature.
--tr, --timestamp-server <TimeStampServer>
Specifies the URL of the RFC 3161 timestamp server. Time stamping is important for proving when a file was signed. If this option is not included, the signed file will not be timestamped, and a warning will be generated if timestamping fails.
--td, --timestamp-digest <DigestAlgorithm>
Specifies the digest algorithm used by the RFC 3161 timestamp server. This option is required if the --tr option is provided. Supported algorithms include SHA256, SHA384, and SHA512.
--fb, --fallback-timestamp-server <FallbackTimeStampServers>
Specifies one or more URLs for RFC 3161-compliant timestamp servers to use as fallbacks if the primary timestamp server (--tr) fails. Provide multiple servers by repeating this option. The servers are tried sequentially, stopping at the first successful response.
--st, --separate-timestamp
Enables a separate time-stamping step after signing. This option is automatically activated if any fallback timestamp servers (--fb) are specified.
--vc|--verify-cert-chain
Verifies the certificate chain before signing. If not set, the chain is not verified (default). Enables --revocation-mode and optionally --ignore-untrusted-root.
--rm, --revocation-mode <Mode>
Specify the revocation check mode when building the certificate chain. Only used during signing when --verify-cert-chain is enabled.
By default, the chain-building process may try to check the certificate status against online Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) responders. If these URLs are inaccessible or slow to respond — possibly due to firewall restrictions, then changing the revocation mode can improve signing performance. The parameter accepts the following <Mode> values:
Note: Software signed with a revoked certificate may trigger trust warnings or be blocked by operating systems. We therefore recommend checking and adjusting your firewall settings first. Ensure that it permits outbound HTTP (port 80) and HTTPS (port 443) traffic to the CRL and OCSP URLs specified in your certificates.
--ignore-untrusted-root
Ignore untrusted root errors. When signing, it allows certificate chains that do not terminate in a trusted root (requires --verify-cert-chain). When verifying, this skips errors caused by unknown or self-signed root certificates.
--as, --append-signature
Appends this signature to the file. If no primary signature exists, this signature will become the primary one. This is useful for signing files multiple times without overwriting existing signatures. Note that appending signatures requires Windows 11 or later.
--vf, --verify
Verifies the signature after signing to ensure it is valid.
--skip-signed
Skips any files that have been previously signed.
--allow-untrusted
Allows signing using a Signotaur server that is bound to an untrusted or invalid certificate. Use this option with caution, as it may expose you to security risks
--continue-on-fail
Continues signing subsequent files even if an error occurs while signing a file. This option is useful for batch signing scenarios where you want to attempt to sign all files regardless of individual failures.
--fl, --file-list <FileName>
Specifies the path to a file containing a list of files to sign. This is useful for batch signing multiple files without specifying them individually on the command line.
Each line in the file must follow this format:
FilePath|Description|URL|ApplicationName
*, ?, **) to match multiple files. The tool will interpret each path just as it does for the Files parameter.-d or --description option for the specified file or matching files.-du or --description-ul option for the specified file or matching files.--an or --app-name option for the specified file or matching files.Quoting and escaping rules
|) or a double quote (").|) or a double quote ("), it must be enclosed in double quotes ("").\").\) must be escaped (\\) inside a quoted field, but remain unchanged if unquoted.Example entries
C:\Folder\*.exe
/home/user/*.so|Sample description
"C:\Projects\**\file.dll"|"A \"quoted\" description"|"http://example.com"
"C:\Dev\drivers\*.sys"|"System drivers"|http://example.com
"*.dll"|"This description contains a | pipe character"|http://example.com
"E:\Publish\App\app.exe"|Description with spaces|https://example.com
--asu, --auto-self-update
Automatically checks for and installs updates before signing.
If an update is installed, the updated version restarts with the same command-line arguments, excluding this option.
--update-mode <Mode>
Choose 'Version' to update to every new release, or 'SourceHash' (default) to update only when the source code hash differs (e.g. when there are changes).
--request-timeout <TimeoutInSeconds>
Specifies the request timeout for server requests in seconds. If the server takes longer than the specified time to respond, the operation will be aborted. Default is 0 for automatic timeout calculation based on number of files
-m, --max-degree-of-parallelism <MDOP>
Specifies the maximum number of concurrent file signing operations. This setting allows you to control the degree of parallelism to optimize performance. The default value is 4, but you can adjust this based on the capabilities of your machine.
--encoding <Encoding>
Specifies the output encoding. Set to one of UTF8, UTF16, OEMCodePage or CodePage### where ### is the number of the code page to use. Defaults to UTF8.
-v, --verbose
Enables verbose logging for the signing operation, providing detailed output of the signing process, which can be useful for debugging.
--nb, --no-banner
Hides the banner in the output, which may be useful for scripting or logging purposes where you want a clean output.
--help
Displays help information and usage instructions for this command.
Sign multiple files with a specified thumbprint:
SignotaurTool.exe sign -a <APIKey> -s <SignServer> -t <Thumbprint> file1.exe file2.dll
Sign files with timestamping:
SignotaurTool.exe sign -a <APIKey> -s <SignServer> -t <Thumbprint> --tr <TimeStampServer> --td SHA256 file1.exe file2.dll
Sign files with timestamping and verification:
SignotaurTool.exe sign -a <APIKey> -s <SignServer> -t <Thumbprint> --tr <TimeStampServer> --td SHA256 --vf file1.exe file2. ```
The sign command supports signing the following file types: .appx, .appxbundle, .cab, .cat, .cdxml, .dll, .eappx, .eappxbundle, .emsix, .emsixbundle, .exe, .msi, .msix, .msixbundle, .msm, .msp, .mst, .ocx, .ps1, .ps1xml, .psd1, .psm1, .stl, .sys, .vbs, .vxd, .winmd. Additional PE file types may also be signed automatically.
If the input includes a .application file (ClickOnce deployment manifest), or a .vsto file (Visual Studio Tools for Office add-in manifest), the sign command automatically detects, hashes and signs all related application files and manifests in the required order.
This ensures the entire ClickOnce/VSTO deployment package is properly signed, including:
.application or .vsto file itself).manifest)This recursive signing makes ClickOnce deployments seamless and secure, with no need to manually list each file.
The following exit codes indicate the result of the operation performed by SignotaurTool.exe:
Typically a more specific message will be displayed before an error exit code is returned.
Server Connection Issues:
Signotaur server URL is reachable.--allow-untrusted.Certificate Not Found:
File Signing Errors: