Code Signing Key Management Server (CSKMS)

Paid APISelf-hosted

Visit Code Signing Key Management Server (CSKMS) Alternatives

Code Signing Key Management Server (CSKMS)'s own site

What Code Signing Key Management Server (CSKMS) is

Code Signing Key Management Server (CSKMS) protects code-signing keys and signs firmware, applications, software images, block images, and hash fingerprints. BlackBerry Certicom describes it for IC manufacturers and OEMs securing device software. Signing can use a hash provided in advance or calculate one from a presented file. Supported digital-signature algorithms include RSA, ECDSA, LMS, XMSS, and Dilithium; AES key management covers file encryption and key wrapping, and MACs support image authentication. The server offers RESTful web-service APIs for signing clients, backend over-the-air services, and device-provisioning systems, with custom integration services available. Keys can be organized into groups with user permissions and M-of-N hardware tokens for administration. The datasheet describes protection in a FIPS 140-2 Level 3 physical HSM, plus signature logs and an audit trail of key use. CSKMS can operate offline in an isolated security bunker or connect through secure web services for automated signing. It is offered as paid software, with pricing available on request.

Who it suits

CSKMS suits IC manufacturers and OEMs that need controlled signing of device software. It also fits teams that require either offline token-based administration or automated signing through web services.

What it does well

Supports RSA, ECDSA, LMS, XMSS, and Dilithium signatures.
Signs supplied hashes or computes hashes from files.
FIPS 140-2 Level 3 HSM key protection.
Provides RESTful APIs and custom integrations.
Offers offline and automated signing deployment options.

What to know first

Pricing is available on request.
Premium support response times range from one business hour to one business day.

Getting started

Visit the CSKMS product website.
Choose an API or self-hosted deployment approach.
Contact Certicom for pricing on request.
Use the RESTful API or web-service APIs to connect signing clients and backend systems.

Verdict

CSKMS combines protected key administration, multiple signature algorithms, and integration options for firmware and application signing. Pricing requires a request, and deployment can be offline or connected through secure web services.

Questions

How much does CSKMS cost?

CSKMS is paid, with pricing available on request.

What does CSKMS sign?

It supports firmware, applications, software images, block images, and hash fingerprints.

Which signature algorithms does it support?

The listed algorithms are RSA, ECDSA, LMS, XMSS, and Dilithium.

How are signing keys protected?

The datasheet describes protection in a physical FIPS 140-2 Level 3 HSM.

Can CSKMS integrate with other systems?

RESTful and web-service APIs support integration with code-signing clients, backend over-the-air services, and device-provisioning systems. Custom integration services are also available.

Facts from Code Signing Key Management Server (CSKMS)'s own pages

Access controls: Signing keys can be administered using key groups and user permissions, with M-of-N hardware tokens for administration and control. · certicom.com, 4 Oct 2026
Additional features: The datasheet lists WebAuthn remote-token support, signing-key administration with key groups and user permissions, and certificate self-signing or CSR export. · certicom.com, 10 Oct 2026
Administration and audit: The product page says CSKMS securely logs key usage and metadata. · certicom.com, 10 Oct 2026
Algorithms: It supports RSA, ECDSA, and quantum-resistant digital signatures, plus NIST-approved key derivation, encryption, and key-wrapping algorithms with selectable bit strengths. · certicom.com, 10 Oct 2026
Audit logging: The server logs signatures and associated metadata, and the datasheet describes an audit trail of users or applications that used protected keys. · certicom.com, 4 Oct 2026
Custom integration: The datasheet says custom integration services are available. · certicom.com, 10 Oct 2026
Deployment: It can run offline in an isolated security bunker, where security officers present tokens to access restricted project keys, or connect through secure web services for automated signing. · certicom.com, 10 Oct 2026
Deployment hardware: The datasheet describes a hardened server appliance with a CentOS 7-based secure operating environment. · certicom.com, 4 Oct 2026
Encryption: The KMS supports AES key management for file encryption and key wrapping, as well as MAC-based image authentication. · certicom.com, 4 Oct 2026
Founded: 1985 · certicom.com, 28 Sept 2026
Hardware security: The server uses FIPS 140-2 certified hardware security modules to protect sensitive keying material. · certicom.com, 10 Oct 2026
Integration: Web-service APIs support integration with backend over-the-air services and device-provisioning systems, including Certicom’s Asset Management System. · certicom.com, 10 Oct 2026
Integrations: It provides a RESTful API for code-signing clients and offers custom integration services. · certicom.com, 4 Oct 2026
Intended users: Certicom describes the server as a solution for manufacturers protecting device software and firmware, including critical-infrastructure, industrial-control, aerospace, military, telecommunications, transportation, and connected-car applications. · certicom.com, 10 Oct 2026
Key permissions: It manages signing privileges for key sets and authorized user groups. · certicom.com, 10 Oct 2026
Key protection: The datasheet says keys are protected in a FIPS 140-2 Level 3 physical HSM. · certicom.com, 4 Oct 2026
Maker history: Certicom says it was founded in 1985 and acquired by BlackBerry in 2009. · certicom.com, 10 Oct 2026
Purpose: CSKMS manages access to code-signing and encryption keys, signs software images, and can optionally encrypt them for target projects. · certicom.com, 10 Oct 2026
Signature algorithms: The datasheet lists RSA, ECDSA, LMS, XMSS and Dilithium digital signatures. · certicom.com, 4 Oct 2026
Signing options: The datasheet states that the server can sign a precomputed hash or compute and sign a hash from a presented file image, logging the signature and metadata. · certicom.com, 10 Oct 2026
Support: Certicom lists Standard and Premium support options; Premium support includes 7×24 hours and a stated response time of one business hour to one business day on its support-offerings page. · certicom.com, 10 Oct 2026

Where Code Signing Key Management Server (CSKMS) stands on Freedom251

Code Signing Software#22 of 28