Google Cloud KMS Code Signing: setup guide

This guide covers setting up Google Cloud KMS for Code Signing. Google Cloud KMS provides HSM-backed keys (FIPS 140-2 Level 3) at a lower cost than Azure Key Vault, but requires more command-line work for CSR generation and initial setup.

Works with both OV and EV Code Signing certificates from DigiCert and GlobalSign.

Prerequisites

✓
Google Cloud project with billing enabled
✓
gcloud CLI installed and authenticated. Download from cloud.google.com/sdk ↗
✓
OpenSSL (for CSR generation via PKCS#11)
✓
Java 11+ (if using Jsign for signing)
✓
A Code Signing certificate from FairSSL (DigiCert or GlobalSign). See products below

More technical than Azure Key Vault. Google Cloud KMS requires PKCS#11 library configuration and OpenSSL for CSR generation. If you are new to cloud HSM and want the simplest setup, Azure Key Vault is easier to get started with.

Step 1: Enable KMS API and create a key ring

Enable the Cloud KMS API in your project, then create a key ring to hold your signing key.

# Enable the KMS API
gcloud services enable cloudkms.googleapis.com

# Create a key ring
gcloud kms keyrings create codesign-keyring \
  --location global

The location can be global or a specific region. For HSM-backed keys, the location determines which physical HSM is used. global works for most setups.

Step 2: Create an HSM-backed key

gcloud kms keys create codesign-key \
  --keyring codesign-keyring \
  --location global \
  --purpose asymmetric-signing \
  --default-algorithm rsa-sign-pkcs1-4096-sha256 \
  --protection-level hsm

Key settings explained

purpose: asymmetric-signing (the key can sign but not encrypt)
algorithm: rsa-sign-pkcs1-4096-sha256 (RSA 4096-bit with SHA-256)
protection-level: hsm (hardware-backed, FIPS 140-2 Level 3)

The private key is generated inside the HSM and can never be exported. All signing operations happen on the HSM hardware. This meets the CA/Browser Forum requirement for Code Signing key storage.

Step 3: Grant IAM permissions

The service account used for signing needs the Cloud KMS CryptoKey Signer role.

# Create a service account for signing
gcloud iam service-accounts create codesign-signer \
  --display-name "Code Signing Service Account"

# Grant signing permission on the key
gcloud kms keys add-iam-policy-binding codesign-key \
  --keyring codesign-keyring \
  --location global \
  --member "serviceAccount:codesign-signer@YOUR_PROJECT.iam.gserviceaccount.com" \
  --role "roles/cloudkms.signerVerifier"

# Create a service account key file (for use outside GCP)
gcloud iam service-accounts keys create ~/codesign-sa-key.json \
  --iam-account codesign-signer@YOUR_PROJECT.iam.gserviceaccount.com

Store the service account key file securely. This JSON file grants signing access. In CI/CD, use workload identity federation or store the key as a secret variable.

Step 4: Generate CSR using PKCS#11

Unlike Azure Key Vault (which generates the CSR in the portal), Google Cloud KMS requires you to use the PKCS#11 library and OpenSSL to generate the CSR.

Install the PKCS#11 library

Download the Google Cloud KMS PKCS#11 library from the Cloud KMS PKCS#11 documentation ↗.

Create PKCS#11 configuration file

Create a YAML config file (e.g. pkcs11-config.yaml):

tokens:
  - key_ring: "projects/YOUR_PROJECT/locations/global/keyRings/codesign-keyring"
    label: "codesign"

Generate the CSR with OpenSSL

# Set environment variables
export KMS_PKCS11_CONFIG=./pkcs11-config.yaml
export GOOGLE_APPLICATION_CREDENTIALS=~/codesign-sa-key.json

# Generate CSR
openssl req -new \
  -subj "/CN=Your Company Name" \
  -sha256 \
  -engine pkcs11 \
  -keyform engine \
  -key "pkcs11:object=codesign-key;type=private" \
  -out codesign.csr

The -key parameter references the KMS key via the PKCS#11 URI. The CN must match the company name registered with the CA.

Add Code Signing EKU to the CSR

Create an OpenSSL extensions file (e.g. codesign.cnf) to include the Code Signing EKU:

[ req ]
req_extensions = v3_req

[ v3_req ]
keyUsage = digitalSignature
extendedKeyUsage = codeSigning

Then add -config codesign.cnf to the OpenSSL command above.

Step 5: Order certificate and submit CSR

1
Order a Code Signing certificate from FairSSL. Choose DigiCert or GlobalSign, OV or EV. See products below.
2
Submit the CSR file (codesign.csr) during the order process.
3
Complete organisation validation. FairSSL handles the validation process.
4
Receive the signed certificate from the CA.

Step 6a: Signing with the CNG provider (Windows)

Google provides a Windows CNG (Cryptography Next Generation) provider that enables native signtool.exe support. This lets you use signtool.exe just like with a local certificate store or USB token.

Install the CNG provider

Download the Google Cloud KMS CNG provider from the Cloud KMS CNG documentation ↗
Install the MSI package
Import your signed certificate into the Windows certificate store (certutil or MMC snap-in)
The CNG provider links the certificate to the KMS key

Sign with signtool

signtool sign /sha1 YOUR_CERT_THUMBPRINT /fd sha256 ^
  /tr http://timestamp.digicert.com /td sha256 ^
  "MyApplication.exe"

The CNG provider transparently routes the signing operation to Google Cloud KMS. signtool.exe works exactly as it would with a local key.

Step 6b: Signing with Jsign (cross-platform)

Jsign ↗ is a free, open-source Java-based signing tool that supports Google Cloud KMS natively. It works on Windows, macOS and Linux without the CNG provider.

Install Jsign

Download from ebourg.github.io/jsign ↗. Requires Java 11 or later.

Sign with Jsign

jsign --storetype GOOGLECLOUD \
  --storepass "$(cat ~/codesign-sa-key.json)" \
  --keystore "projects/YOUR_PROJECT/locations/global/keyRings/codesign-keyring" \
  --alias "codesign-key" \
  --certfile codesign-cert.pem \
  --tsaurl http://timestamp.digicert.com \
  --tsmode RFC3161 \
  MyApplication.exe

Parameter reference

--storetype GOOGLECLOUD Use Google Cloud KMS backend
--storepass Service account JSON key content
--keystore Full KMS key ring resource path
--alias Key name within the key ring
--certfile Signed certificate file from the CA (PEM format)
--tsaurl RFC 3161 timestamp server

Timestamping

Always include an RFC 3161 timestamp when signing. Code Signing certificates have a maximum validity of 459 days, but timestamped signatures are valid indefinitely.

Recommended timestamp servers

http://timestamp.digicert.com (recommended)
http://timestamp.globalsign.com/tsa/r6advanced1

Troubleshooting

"PKCS#11 module not found" during CSR generation

The PKCS#11 library is not installed or OpenSSL cannot find it. Verify the library path and ensure KMS_PKCS11_CONFIG points to the correct config file.

"Permission denied" when signing

The service account is missing the roles/cloudkms.signerVerifier role on the key. Verify the IAM binding and ensure GOOGLE_APPLICATION_CREDENTIALS points to the correct service account key file.

CNG provider not found by signtool

The Google Cloud CNG provider may not be installed correctly. Reinstall the MSI and ensure the certificate is imported into the Windows certificate store. The certificate must be linked to the CNG provider.

Jsign cannot authenticate

Verify the service account key JSON is valid and that the service account has signing permissions. If using workload identity federation, check that the token exchange is configured correctly.

Code Signing certificates

OV Code Signing

DigiCert CodeSign OV

DigiCert OV Code Signing. Works with Google Cloud KMS.

from €475 /year See details →

GlobalSign CodeSign

GlobalSign OV Code Signing. Works with Google Cloud KMS.

from €375 /year See details →

EV Code Signing

DigiCert CodeSign EV

DigiCert EV Code Signing. Google Cloud KMS + kernel drivers.

from €740 /year See details →

GlobalSign CodeSign EV

GlobalSign EV Code Signing. Google Cloud KMS + higher SmartScreen trust.

from €428 /year See details →

See all products with prices →

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Is Google Cloud KMS cheaper than Azure Key Vault?

Marginally. Google Cloud KMS costs approximately $2.50/month for the HSM key plus a few cents per 10,000 signing operations. Azure Key Vault Premium costs approximately $5/month including 500,000 operations. For most code signing workloads, the cost difference is negligible.

Can I use Sectigo certificates with Google Cloud KMS?

It depends on the CA's key attestation requirements. DigiCert and GlobalSign have documented support for Google Cloud KMS. Check with FairSSL for the latest compatibility information.

Do I need the CNG provider or can I use Jsign?

Either works. The Google Cloud CNG provider gives you native signtool.exe support on Windows. Jsign is cross-platform (Windows, macOS, Linux) and talks directly to the KMS API. For CI/CD pipelines, Jsign is often simpler because it does not require installing the CNG provider.

How do I generate a CSR from Google Cloud KMS?

Use the PKCS#11 library provided by Google Cloud to generate the CSR via OpenSSL. The private key stays in the HSM. The CSR file contains only the public key, which you submit to the CA.

Can I sign from a CI/CD pipeline?

Yes. Use Jsign with a Google Cloud service account key. Jsign connects directly to the KMS API and works in any CI/CD environment that has Java installed. Alternatively, use the CNG provider on Windows-based build agents.

Ready to sign with Google Cloud KMS?

Create a free account and issue your first certificate in under 10 minutes.

Create free account Compare certificates