Editions

Signotaur is available in two editions, plus a time-limited trial. Your edition is determined by the licence installed on the Licences page.

All signing needs a licence of some kind. Your edition then decides two further things:

  • whether the Managed CA features are available: certificates issued and renewed by Signotaur's Internal CA or by Microsoft ADCS;
  • whether document signing is available: registering, issuing and signing with document-signing certificates.

Both need Enterprise, which is a tier above Standard. Code signing works under a Standard licence. A fully licensed Standard server signs code perfectly well, but refuses document signing.

Editions

Edition How you get it
Standard The default. Pre-2.0 licences, and any licence without an edition field, are read as Standard.
Enterprise An Enterprise licence. Unlocks the full Managed CA feature set and document signing.
14-day Enterprise trial Requested from the Licences page. Grants Enterprise-level access for 14 days.

The 14-day trial is Enterprise by virtue of the licence it issues, not a separate edition. Existing Standard or trial licences are not upgraded retroactively; to evaluate the Enterprise features, request a new trial or install an Enterprise licence.

What Each Edition Includes

Feature Standard Enterprise
Code signing with File, Windows Store, and Hardware (PKCS#11 / HSM) certificates Yes Yes
Signing Authenticode (EXE, DLL, MSI, CAT, SYS), AppX/MSIX, NuGet, VSIX, ClickOnce/VSTO, RDP, CMS, and detached signatures Yes Yes
RFC 3161 timestamping with fallback timestamp servers Yes Yes
Web (TLS) certificate from a PFX file, the Windows store, or self-signed Yes Yes
Multi-user management with roles and per-user certificate assignment Yes Yes
API keys with rotation and expiry for unattended CI/CD signing Yes Yes
Two-factor authentication, external authentication (SSO), and password policies Yes Yes
Audit event log, email notifications, and encrypted backup & restore Yes Yes
Issuing and renewing certificates from the Internal CA or Microsoft ADCS — Yes
Automatic renewal of managed web and managed code-signing certificates — Yes
Using managed-CA-issued code-signing certificates for signing — Yes
Web certificate in Use Managed CA mode — Yes
Document signing: registering, issuing and signing with document-signing certificates, including the AdES formats (XAdES, CAdES, PAdES) — Yes

In short: core code signing and the manual web-certificate modes are available in every edition. The Managed CA capability (Signotaur acting as a certificate authority) and document signing both require Enterprise, and are unlocked by the same Enterprise licence. A server that has one has the other.

Licences Are Perpetual

Signotaur licences, Standard and Enterprise alike, are perpetual: they never expire. A licence is sold with a subscription (12 months by default) that covers updates and support, but the licence itself keeps working indefinitely. When the subscription lapses you can keep running the software; the licence stays valid for every Signotaur build that was released before your subscription expired, and is rejected only by newer builds released after that date. Renewing the subscription extends coverage to those newer builds.

The single exception is the 14-day Enterprise trial, which is a time-limited licence that does expire on its end date.

How Servers Without an Enterprise Licence Behave

The Managed CA gate is graceful; it never stops a server or deletes data.

One-Time 90-Day Grace Web Certificate

If you select a Managed CA web-certificate mode without an Enterprise licence, Signotaur issues a single managed web certificate, valid for up to 90 days and with no automatic renewal. This applies on a fresh install, and on the first v1-to-v2 upgrade that enables Managed CA. When that certificate expires while the server is still unlicensed, Signotaur automatically reverts the web certificate to self-signed; no manual action is needed.

The grace is one-time per server and cannot be reset: once a managed web certificate has ever been issued on a server, reconfiguring a Managed CA mode while unlicensed is blocked. The installer reports an error, the configure command leaves the certificate configuration untouched, and the server refuses to reissue.

When a Server Is No Longer Enterprise-Licensed

A valid Enterprise licence may stop being present for several reasons: the 14-day trial reached its end date, the Enterprise licence was removed, or the server was updated to a build released after the Enterprise licence's subscription expired (see Licences Are Perpetual). What happens next depends on whether any other valid licence remains.

If a valid Standard licence is still installed, the server falls back to standard behaviour. Nothing is torn down:

  • Existing certificates are preserved on disk.
  • The managed web certificate keeps serving until its expiry, then automatically reverts to self-signed.
  • Managed code-signing certificates are hidden from the certificate lists and rejected at signing time.
  • Document signing is refused; see Document Signing Without an Enterprise Licence below.
  • Restoring a valid Enterprise licence restores everything automatically; no reconfiguration required.

If no valid licence of any edition remains, the server is unlicensed. A valid licence, of any edition, is required to sign, so an unlicensed server rejects signing and certificate requests from the client tool (responding "Server is not licensed") until a licence is installed. The admin web UI stays available so an administrator can add one.

Document Signing Without an Enterprise Licence

On a Standard server, or any server without a valid Enterprise licence:

  • Issuing a document-signing certificate, from the Internal CA or from ADCS, is refused with "Document signing requires an Enterprise licence."
  • Registering a certificate that can only do document signing is refused for the same reason. A certificate that can do both code signing and document signing registers normally and stays usable for code signing.
  • Certificates that can only do document signing are hidden from the Signing Certificates list, from Account → My Certificates, and from the file, store and hardware pickers in the register dialogs. They are hidden, not deleted, and reappear automatically once an Enterprise licence is present.
  • Signing with a document-signing certificate is refused by the server itself, so the gate holds for REST and gRPC integrators as well as for the SignotaurTool client.
  • The SignotaurTool client refuses to produce document signatures. It fails closed: a server too old to report whether document signing is permitted is treated the same as one without an Enterprise licence, so upgrade the server if its licence already covers it. Only the document files in a batch are refused; code files in the same run still sign. The run ends with exit code 87.
  • Automatic renewal of near-expiry managed document-signing certificates is paused, and those certificates are allowed to lapse rather than be renewed. Renewal resumes automatically when an Enterprise licence is restored. (Managed certificate renewal in general is part of Managed CA, which is itself Enterprise, so this is what a reader sees when an Enterprise licence is lost.)

The GetCertificate response carries a DocumentSigningPermitted flag, so an integration can check the server's entitlement before attempting to sign. A signing request that uses a document-signing certificate on a server without the entitlement is answered with HTTP 423 (Locked) and a message saying the certificate requires an Enterprise licence.

See Document-Signing Certificates and Signing Documents.

Managing Licences

Install, view, and remove licences (and request a trial) on the Licences page.