SimplySign Desktop: Set Up Certum Code Signing in 5 Steps

What do you need before you start?

A Certum cloud code signing certificate needs four things, by Certum's own list: the SimplySign mobile app on an Android or iOS phone, the SimplySign Desktop application on the computer that will sign, a SimplySign account, and internet access. The account is created during certificate activation, and no USB token or card reader is involved.

The fifth thing is the certificate. Disclosure: My-SSL sells Certum code signing certificates and delivers them through SimplySign. If you have not ordered yet, the Standard code signing certificate for individuals and organizations starts at $99 for a one-year term, and the rest of this page shows what the setup looks like once it is issued.

One warning before you search for help: Certum also sells a qualified electronic signature under the SimplySign name. Pages about that product describe signing documents, and they share the apps with code signing but not the ordering or verification steps.

Which operating systems does SimplySign Desktop support?

As of October 11, 2026, Certum lists SimplySign Desktop for 64-bit Windows 10 and Windows 11, for macOS Sonoma, Sequoia and Tahoe, and for five Linux distributions: Debian, Ubuntu, Mint, CentOS and Fedora. The Linux build needs a Cinnamon, MATE or KDE Plasma desktop. Every platform needs internet access.

Download the build for your system from Certum's software page and run the installer; Windows gets an .exe and an .msi. Two details in the table save time. First, the requirement for a graphical desktop on Linux means a headless build server is outside what Certum lists. Second, older pages disagree with it: Certum's shop page for the qualified signature still names Windows 8 and macOS Catalina through Ventura. The software page was modified on September 15, 2026 and carries the current builds, so follow that one.

On a Mac you can also install with brew install --cask simplysign, which pulls the same 2.10.24-9.4.5.0 package from Certum. Homebrew's listing says the app is built for Intel and needs Rosetta 2 on Apple Silicon, while Certum's page says ARM is supported. If the app will not start on an M-series Mac, installing Rosetta 2 is the first thing to try.

How do you activate the certificate and the mobile app?

Activation of a Certum cloud code signing certificate happens in two places. In the Certum account you submit your data, pass verification and choose a key that is generated on the virtual card. Certum installs the issued certificate on the SimplySign account without a file download, and once it is issued you pair the SimplySign mobile app on your phone by scanning a QR code.

1. Start the activation. Certum's manual begins in the store account, under My account in the Data security products tab. For an order placed through a reseller, the manual has the partner start it from Certum's partner panel instead.
2. Submit and verify your data. An individual verifies identity, either through Certum's automatic identity verification service or by attaching an identity document. An organization is checked by registration number in a public register or by document. Our guide to the documents Certum asks for lists them by applicant type.
3. Choose the key. For a cloud certificate the only storage option is the cloud: the manual says the keys are saved on the virtual cryptographic card in the SimplySign cloud. You pick the algorithm and key length; Certum's minimum is RSA 3072.
4. Name the SimplySign account. Use an existing account or give an e-mail address for a new one. That address becomes your SimplySign login, so pick a mailbox the person who signs releases can read.

When Certum issues the certificate it is installed on the SimplySign account you named. Certum's manual gives no waiting time for verification; our page on how long code signing validation takes covers what moves it along.

Then pair the phone. Certum's support page says the app can be activated once the certificate is issued. Certum sends a welcome e-mail, an e-mail with an activation link and a separate e-mail with an activation code. Install the SimplySign app, open the link, enter the code, and the page shows a QR code. Choose the QR code method in the app and scan it.

The steps above are from Certum's manual for the Standard certificate. Certum's EV product page lists organization data only, so the EV code signing certificate is for organizations, at $299 for a one-year term.

How do you connect SimplySign Desktop?

To connect SimplySign Desktop on Windows, right-click its icon in the system tray, choose Connect to SimplySign, then enter your username and the token shown in the SimplySign mobile app. The username is the e-mail address given at activation. A notification then reports how many cards and certificates the app found.

Next, collect the one value SignTool needs. Open Manage certificates, then Certificate list, show the certificate, go to the Details tab and copy the Thumbprint field. It is a 40-character hexadecimal string; if your copy contains spaces, remove them.

Certum does not publish how long a connection stays open, so do not build a release process on a number someone quoted in a forum. Assume a person with the phone has to connect before each signing session, and check the tray icon before a long build.

How do you sign an EXE with SignTool?

With SimplySign Desktop connected, signing an EXE is one SignTool command: select the certificate by its thumbprint with /sha1, timestamp against Certum's RFC 3161 server with /tr and /td sha256, and set the file digest with /fd sha256. SignTool prints "Successfully signed" and the file name when it works.

signtool sign /sha1 "<thumbprint>" /tr http://time.certum.pl /td sha256 /fd sha256 /v "app.exe"

Microsoft's SignTool reference says Windows SDK builds 20236 and later require /fd when signing and /td when timestamping; a missing option was a warning at first and is an error in later SignTool versions. Microsoft also says /td has to come after /tr; in the other order the timestamp comes back as SHA-1.

What happens next depends on the card. For a card with a PIN, a window asks for the SimplySign card PIN after the first signing command. For a pinless card the manual says the file is signed immediately. To sign several files in one go, list them all at the end of the same command.

signtool verify /pa /all "app.exe"

/pa applies the Default Authentication Verification Policy instead of the driver policy, and /all checks every signature in the file. For the rest of SignTool, including MSI and DLL files, see how to sign an EXE with SignTool, and for what the timestamp buys you after the certificate expires, see code signing timestamps.

What about JAR files, Linux and macOS?

JAR files are signed with jarsigner, which reaches the SimplySign card through the SimplySign PKCS#11 library on Windows. Certum's signing manual documents Windows only. For Linux and macOS, Certum's product page says the certificate supports signing with tools installed on those systems, without a step-by-step manual.

name=SimplySignPKCS.dll
library=C:\Windows\System32\SimplySignPKCS.dll
slotListIndex=0

Pass that file to jarsigner with -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg provider.cfg, add -tsa http://time.certum.pl for the timestamp and -certchain with a file that holds your certificate first and the intermediate below it. The manual adds three cautions. It names a second default library path, so confirm which DLL exists on your machine. jarsigner wants a PIN value even for a pinless card; any value works there. The top card in SimplySign Desktop's list is slot 0, and adding or removing cards changes the order, so the manual recommends checking the slot before each signing. Our jarsigner walkthrough has the full command.

If your build runs on Linux or macOS and produces Windows binaries, Certum publishes no manual for it. Our guide on how to sign a Windows EXE on Linux or macOS describes an osslsigncode setup against an open SimplySign session.

Which limits should you plan around?

Plan around three limits with a Certum cloud code signing certificate. As of October 11, 2026, Certum allows 5,000 signatures a month, a single certificate is valid for at most 459 days, and each connection needs a token from the paired phone. Each one affects how you script a release.

5,000 signatures a month

Certum's product pages say that going over the limit may lead to Certum contacting you and to the product being blocked for the month in which the limit was used up. Certum does not define what counts as one signature. If each signed file counts once, the arithmetic is simple: divide 5,000 by the number of files you sign in a build. Signing a file twice, as in SHA-1 plus SHA-256 dual signing, would count twice on the same assumption.

459 days per certificate

Since February 27, 2026 a single Certum code signing certificate is valid for at most 459 days, so a two- or three-year purchase includes one or more free reissues. A reissued certificate is a new certificate with a new thumbprint. A build script that hard-codes /sha1 keeps pointing at the old certificate, so keep the thumbprint in one variable and note the reissue date next to it. The validity and reissue guide explains the term arithmetic.

A person opens the session

Certum documents the connection as something a user does with a token from the mobile app, and we found no Certum page that describes unattended or build-server use. If you need signing inside a pipeline, read code signing in CI/CD before you design around it, and decide who holds the phone on release day.

What can go wrong?

Certum's and Microsoft's documentation point to five causes of a failed SimplySign signing run: the desktop app is not connected, a SignTool digest option is missing or in the wrong order, the thumbprint belongs to a certificate that is no longer on the card, jarsigner points at the wrong slot, or the phone is set to a right-to-left language.

For SignTool's own error codes, the SignTool error reference goes through them one by one. And if you are still deciding whether a cloud key suits your team at all, code signing certificates explained covers the options.