This section provides information to help you configure Signotaur correctly, troubleshoot common issues, ensure your service user account has the necessary permissions, and back up important data.
The main configuration for Signotaur's service and website is set during installation. Many of these settings can be updated by rerunning the installer. Additional settings, such as those for email service and authentication providers, can be specified in the Admin section of the web interface. For access to the full set of server settings, the Signotaur configuration file is available. For details on these settings and how to customize them for your needs, please refer to the Configuration File page.
Signotaur can act as a Certificate Authority (running its own Internal CA or delegating to Active Directory Certificate Services) and use it to automatically issue and renew the server's web certificate and your code-signing certificates. The Certificate Management section explains the certificate hierarchy, the Internal CA and ADCS issuers, and how renewal and retention work.
Signotaur encrypts the secrets it stores: passwords, OAuth client secrets, and certificate key passwords. The master key that protects them is sealed to the machine with DPAPI, which means configuration and keys cannot simply be copied to another host. The At-Rest Encryption page explains what is protected, the encryption-status badges in the website footer, and how to recover or migrate to a new machine.
Signotaur can take scheduled backups and full, passphrase-encrypted .sigbak archives that capture the configuration, database, and all certificates in one file. Scheduled backups are configured on the Backup Settings page. The server archive command creates, restores, verifies, and extracts these archives from the command line, and is the supported way to migrate a server to a new machine.
Signotaur operates on your system under a designated service account. This account needs specific permissions to access resources on your server, such as files and certificates. The Permissions page outlines the necessary permissions and provides instructions on configuring them for Signotaur.
If you encounter issues with configuration or permissions, refer to the Troubleshooting page for potential solutions. This guide will help you diagnose and resolve common problems, allowing you to quickly identify and address any issues that may prevent Signotaur from running as expected.
When the Signotaur server website uses a self-signed certificate, or a certificate from a private CA whose root is not yet trusted, browsers may display security warnings. To learn how to distribute the trust anchor to clients and address these warnings, visit the Trust Distribution page for detailed instructions.
Signotaur can be deployed behind a reverse proxy, for example to centralise TLS certificate management or present a friendly hostname. Because the SignotaurTool client communicates over gRPC, the proxy must be configured to forward that traffic correctly. The Running Behind a Reverse Proxy page explains the requirements and provides a working nginx example.
To ensure that the service can be recovered in the event of a hardware failure or operating system failure, ensure that both the configuration file Signotaur.Server.config.json and database Signotaur.Server.db are regularly backed up and copied to another computer.