sslTrus Remote Code Signing Service

What sslTrus Remote Code Signing Service is

sslTrus Remote Code Signing Service provides remote cloud signing for software applications. It generates private keys inside FIPS 140-3-compliant cloud HSMs and keeps them there; keys are never exported. The FAQ describes a source-code-zero-upload design, and signing transmission is end-to-end encrypted. The service records each signature in tamper-proof logs and provides software supply chain audit records. Supported targets include Windows Authenticode formats such as EXE, DLL, OCX, MSI, CAB, and kernel drivers, along with Java JARs, macOS applications, Office macro or VBA files, Firefox XPI extensions, Adobe AIR applications, and Silverlight XAP files. Compatible CI/CD environments named by the provider include Microsoft Azure, GitHub Actions, Jenkins, CircleCI, and GitLab; listed build tools include Apache Ant, Gradle, and Maven. After certificate issuance, users install lightweight signing tools on a server or computer, while critical encryption occurs in the cloud HSM. Plans start at $75/yr for 1,000 signatures per year, with higher annual limits available. A successful signing call counts as one use regardless of file size; failed signatures are not charged.

Who it suits

It suits software teams that need remote signing across supported application formats, build tools, or CI/CD environments. Shared policies and audit standards support teams working across regions.

Limits

The Basic plan costs $75 a year and includes 1,000 signatures. Pro, Enterprise, and Ultimate raise the annual allowance to 5,000, 15,000, and 100,000 signatures; each successful signing call counts once regardless of file size.

Getting started

1. Open the sslTrus cloud code-signing website
2. Choose an annual Cloud Code Signing plan
3. Obtain certificate issuance
4. Download the lightweight signing tools
5. Install the tools on a server or computer
6. Connect a listed CI/CD environment or build tool

Verdict

sslTrus offers cloud-based signing with HSM-held keys, audit records, and compatibility across a broad range of formats and tools. Teams should match their annual signature volume to a plan and plan for local signing-tool installation.