The Signotaur configuration file Signotaur.Server.config.json is located in the %ProgramData%\VSoft\Signotaur\Server folder. It stores the core Signotaur settings, including authentication, database connections, email settings, site configurations, logging, and encryption. As such, it should be kept secured and backed up at all times.
Editing it while Signotaur is running has no effect, and the change is usually lost: the server keeps the whole configuration in memory and rewrites the file whenever anything saves, including background tasks you did not trigger.
Stop the Signotaur service, edit the file, then start it again.
Any setting you can reach in the Admin section of the web interface is better changed there. Many of those apply immediately, with no restart, and the interface tells you when one does need a restart.
Below is a description of each section and setting to help administrators understand and customize the configuration.
false, which makes external logins session-only and subject to the SessionExpiryInMinutes idle timeout below. Set it to true to give them the longer RememberMeExpiryInMinutes lifetime instead. This is a deployment-wide setting: external logins have no per-user "remember me" choice.Note: These settings can and should be edited in the Admin section of the Signotaur website.
true to allow users to log in using Google credentials.Note: These settings can and should be edited in the Admin section of the Signotaur website.
true to allow users to log in using GitHub credentials.Defines the password requirements if Signotaur uses a traditional username-password login.
!@#$%) in the password if set to true.true.true.true.Defines the expiration periods for various tokens, links and cookies used by Signotaur server.
true, Signotaur automatically applies database migrations on startup, ensuring the database schema is up-to-date.Changing this setting is not recommended.
Configuration for scheduled automatic backups. When a backup passphrase is set, each scheduled run produces a full, restorable .sigbak archive (config, database, and all certificates); otherwise it falls back to a database-only copy.
These settings are best managed from the Backup tab of the Admin → Settings page. See Backup Settings for the full description, and the archive command for manual backup, restore, verify, and migration.
false.["Monday", "Tuesday"]).HH:mm format. Default: 02:00.%ProgramData%\VSoft\Signotaur\Server\backups is used. Within this root, backups are organised into pools: archives (full .sigbak archives, scheduled and manual), database (database-only fallback copies), cert-rollback (pre-change copies made by certificate operations), and pre-upgrade (installer pre-upgrade snapshots).14). Counts .sigbak archives and database-only copies together as one pool; the newest N across both are kept. The cert-rollback and pre-upgrade pools are retained separately. Set to 0 to keep all backups..sigbak archives. Stored encrypted at rest. When set, scheduled backups are full restorable archives; when unset they are database-only and not portable to another host.Do not edit EncryptionPassphrase directly; the server expects an encrypted value, and the passphrase cannot be recovered if lost. Set it from the Backup Settings page or supply one per-archive with the archive command.
Settings for the outgoing mail server used to send verification and password reset emails.
Note: These settings can and should be edited in the Admin section of the Signotaur website.
25. Commonly 587 for STARTTLS or 465 for implicit TLS.StartTlsWhenAvailable. The values are None (no encryption), Automatic (let the mail library decide from the port), SslOnConnect (TLS from the start, normally port 465), StartTls (connect in the clear and require an upgrade to TLS) and StartTlsWhenAvailable (upgrade to TLS if the server offers it).Do not change this directly as the server expects it to be encrypted.
Settings for the web server hosting Signotaur.
Note: These settings can and should be updated via the Signotaur installer.
7575). It always serves HTTPS. The Internal CA's validation service can listen on a plain-HTTP port of its own; see BuiltIn.ValidationAuthority.HttpPort below.If the port is already in use when the service starts, Signotaur stops with a message naming the port, rather than failing with a generic start-up error. Free the port, or change it with server.exe configure --port <port>, then start the service again.
Settings for the HTTPS (TLS) certificate the Signotaur website presents.
Note: These settings can and should be configured via the Signotaur installer or the Web Certificate admin page.
Mode: Selects how the web certificate is sourced. One of:
PfxFile: load a .pfx file from disk.CertificateStore: load a certificate from the Windows certificate store.SelfSigned: generate (and reuse) a self-signed certificate.ManagedCa: use a certificate issued and automatically renewed by Signotaur's certificate management infrastructure.Each mode reads its settings from the matching sub-block below; the sub-blocks for the other modes are ignored.
The following options apply regardless of the selected mode:
true, Signotaur will allow self-signed or otherwise invalid certificates.true, allows certificates with untrusted root CAs (default: true).Online, Offline, or NoCheck (default: Online)..pfx file containing the SSL/TLS certificate.My).LocalMachine or CurrentUser)..pfx file.true, the server issues and pins a managed web certificate from the active issuer at the next start. The installer sets this when the Internal CA or ADCS certificate mode is chosen; it is cleared automatically once issuance succeeds.Password fields are stored encrypted. Do not edit them directly; the server expects an encrypted value.
Configuration for Signotaur's integrated certificate-management system: the Internal CA, the optional external ADCS issuer, and the automatic renewal of the server's web certificate and code-signing certificates.
These settings are best managed from the Managed Certificates admin page rather than by editing this file. See the Certificate Management section for a full description of the feature.
false, certificates can still be issued and renewed manually from the web interface, but no automatic renewal occurs. Retention cleanup runs regardless of this setting. Default: true.365.Renewal cadence for code-signing certificates and the cleanup policy for replaced (renewed-away) registered certificates.
30.24.true, a code-signing certificate that has been renewed is automatically disabled and later deleted once its grace periods elapse. Default: true.7.30.Renewal cadence for the server's web (TLS) certificate. It applies regardless of which issuer signed the certificate.
30.24.Configuration for the Internal CA.
false. The Internal CA is opt-in. It is set to true automatically when the Internal CA is chosen as the web-certificate source (installer or Web Certificate page), or when it is enabled on the Managed Certificates → Settings tab. When false, the Internal CA settings and the Issue from Internal CA action are hidden, and no Root CA is generated.Signotaur Root CA.20.4096..pfx file. When omitted, a default location under the data directory is used.true, the Root CA private key is expected to be kept offline. Intermediate-CA renewal and generation are blocked unless the Root .pfx file is present. Default: false.Settings shared by every Intermediate CA. The per-purpose issuance defaults live under BuiltIn.Defaults.Intermediates.
180. Global across all Intermediate CAs..pfx file. Retained for older installations; Intermediate CA files are normally named by thumbprint.Older configurations carried Subject, ValidityYears and KeySize here, for the one shared Intermediate CA. On first load after upgrading, any customised values are migrated automatically into BuiltIn.Defaults.Intermediates.AllPurposeIntermediate, the server logs that it seeded them, and the old keys are removed from the file the next time it is saved. Nothing is lost; the configuration file simply changes shape.
Per-purpose issuance defaults for Intermediate CAs. Each block has the same three fields, and each pre-fills the Add / Reissue Intermediate CA dialog and seeds an automatically created Intermediate CA of that purpose.
The blocks are AllPurposeIntermediate, TlsIntermediate, CodeSigningIntermediate and DocumentSigningIntermediate.
Signotaur Intermediate CA, Signotaur TLS Intermediate CA, Signotaur Code Signing Intermediate CA, and Signotaur Document Signing Intermediate CA respectively.5.4096.The extended key usage is not stored here. It is derived from the Intermediate CA's purpose when the CA is created.
Issuance defaults applied when the Internal CA issues a web certificate.
Country is a two-letter ISO code.90. The settings page accepts up to 825. A certificate is never issued to outlive the CA that signs it, whatever this is set to.4096.Issuance defaults applied when the Internal CA issues a code-signing certificate.
Country is a two-letter ISO code.825. The settings page accepts up to 1185. A certificate is never issued to outlive the CA that signs it, whatever this is set to.4096.Issuance defaults applied when the Internal CA issues a document-signing certificate. The fields are the same as for code signing.
825. The settings page accepts up to 1185. A certificate is never issued to outlive the CA that signs it, whatever this is set to.4096.Issuing a document-signing certificate requires an Enterprise licence; see Editions & Licensing.
The Internal CA's validation service. Every value here is read live except HttpPort, which is applied when the service starts. See Validation Authority.
false. It governs issuance only: the OCSP, CRL and CA-Issuers endpoints answer, and the CRL is rebuilt on schedule, whether it is set or not./pki routes, or 0 for none. Default: 0. It must differ from Site.Port, and any other path on it returns 404. Changing it requires a service restart.http://pki.internal. Do not include a /pki path; Signotaur appends it. Leave empty to use this server's own address, resolved each time a certificate is stamped: http:// the site hostname and HttpPort when a port is set, otherwise the site URL. Leaving it empty with no HttpPort while Enabled is set is rejected, because the resulting address would be https://.168. Values below 1 are treated as 1 at runtime.24. Values below 1 are treated as 1 at runtime.168. Values below 1 are treated as 1 at runtime.120. 0 disables the limit.60.false.ValidationAuthority in the file.Both base URLs are written into every certificate issued while they are set, and cannot be changed for certificates that already exist. Choose stable addresses before you start issuing.
The policy certificates state about how the subject's identity was checked. Read live. See Certificate Policy.
http:// or https:// link to your own Certificate Policy / CPS document, written into issued certificates. Signotaur does not host it. Empty stamps the policy identifier with no link.CodeSigning and DocumentSigning are configured independently, each with the same three fields:
false.Lcp, Ncp or NcpPlus. Default: Lcp.false. It never blocks renewal or unattended issuance.Web (TLS) certificates never carry a certificate policy and have no block here.
Where the CRL and issuer certificate are copied when ValidationAuthority.PublicDistributionEnabled is true. Nested under BuiltIn.ValidationAuthority.PublicDistribution in the file. See Public Distribution.
Sftp, Ftp, FtpsExplicit, FtpsImplicit, WebDav or S3. Default: Sftp. Only the block matching the selected transport is used.FileTransfer (SFTP, FTP and FTPS):
0 selects the transport default (22, 21, 21 or 990). Default: 0.pki; Signotaur appends the pki/crl/… and pki/ca/… tree.Password or PrivateKey. SFTP only; FTP and FTPS always use a password. Default: Password.AcceptAny or PinnedFingerprint. SFTP only. Default: AcceptAny.SHA256:… form. Used only when pinning.System or AcceptAny. FTPS only. Default: System.WebDav (HTTPS only):
0 selects 443. Default: 0.System or AcceptAny. Default: System.ObjectStore (S3-compatible):
eu-west-1. Required for AWS; optional when ServiceUrl is set.https://minio.example.com:9000. Empty for AWS.pki.Cache-Control header set on uploaded objects. Default: public, max-age=3600. Empty sends no header.endpoint/bucket/key addressing rather than bucket.endpoint/key. Required by most self-hosted S3-compatible servers. Default: false.Configuration for external Certificate Authority issuers. Currently the only supported external issuer is ADCS (Active Directory Certificate Services).
false, the ADCS settings and the Issue from ADCS action are hidden. Changing this setting requires a service restart. Default: false.CertSrv transport; for example, https://ca.example.com/certsrv/.DCOM transport, in hostname\CAName format; for example, ca.example.com\Example Issuing CA.DCOM (Windows-only, uses the ADCS COM API) or CertSrv (HTTPS, uses the ADCS Web Enrollment role). Default: DCOM.CertSrv transport, accept the ADCS server's TLS certificate even if its chain is not trusted on this host. The hostname must still match. Ignored for DCOM. Default: false.UseIntegratedAuth is true.true, Signotaur authenticates to ADCS as its own Windows service account. When false, the Username and Password are used. Default: true.WebServer.CodeSigning.The validity period, key usage and extended key usage of certificates issued by ADCS are governed by the ADCS certificate template, not by Signotaur. The subject-identity, certificate-policy and identity-attestation settings apply to the Internal CA only.
Defines logging preferences across different outputs. The following minimum log levels can be used set the LogLevel settings:
Error, Warning, Information, etc.).null, default location at %ProgramData%\VSoft\Signotaur\Server\Logs is used.LogLevel: Specifies the logging level for Microsoft libraries used within the application.
Controls logging for the Kestrel web server. These settings are nested under the Microsoft section.
Inherit, uses the Microsoft log level).Inherit).Inherit).Inherit).Inherit).Used to secure sensitive data such as passwords in the application. The AES master key and vector below encrypt every other server secret (OAuth client secrets, SMTP/ADCS passwords, web-certificate PFX passwords, CA key passwords, and the backup passphrase).
The master key and vector are themselves sealed with DPAPI (machine-scoped) the first time the server starts. Once sealed, the values on disk are bound to this machine and cannot be copied to another host; attempting to do so causes the server to fail closed with a clear error. To move a server to a new or rebuilt machine, use the archive command rather than hand-copying these keys. See At-Rest Encryption for the full model, recovery paths, and the encryption-status badges shown in the website footer.
Do not alter these settings. Do not lose the key and vector; if they are lost, the server cannot read any encrypted data. The values are DPAPI-sealed to this machine; to migrate to another host, take a .sigbak backup with archive create and restore it on the destination (restore re-seals the key under the new machine).
DPAPI1:).true.true.5.5000.30.100.2).5).ApiRateLimit and GrpcRateLimit limit how many signing requests a single API key may make. ApiRateLimit covers the REST endpoints (POST /api/v1/sign and POST /api/v1/cert/get); GrpcRateLimit covers the gRPC signing service used by SignotaurTool. They are counted separately, so a key has its own allowance on each transport. Each takes two values:
0, which disables the limit.60.Both are off by default deliberately. Signing workloads are often heavily parallel, such as a CI job signing a batch, so a limit that arrived unannounced would break callers. Turn one on only when you have a reason to, and set it above your busiest legitimate build.
Note: These settings can and should be edited in the Admin section of the Signotaur website.
Each notification block below shares the same three settings:
true).0 disables post-expiry reminders (default: 28).Expiration notifications for the server's web certificate. Default warning days: [30, 14, 7, 3, 1].
Expiration notifications for code-signing certificates. Default warning days: [30, 14, 7, 3, 1].
Expiration notifications for API keys. Default warning days: [30, 14, 7, 3, 1].
Expiration notifications for the Internal CA's Root certificate. Because a Root CA is long-lived and regenerating it is a deliberate operation, warnings start much further out. Default warning days: [365, 180, 90, 30, 7].
Expiration notifications for the Internal CA's Intermediate certificate. These act as a backstop in case automatic renewal does not occur. Default warning days: [60, 30, 14, 7, 1].
All page size values are clamped to the range 1–50. Values below 1 are treated as 1; values above 50 are treated as 50.
6).DefaultPageSize when omitted.DefaultPageSize when omitted.DefaultPageSize when omitted.