2 ms·
The cheaper option is SSL.com eSigner which is also a cloud hosted HSM where you can access it using ordinary saved credentials. In theory they want you to use
by mike_hearn 3y ago
The cheaper option is SSL.com eSigner which is also a cloud hosted HSM where you can access it using ordinary saved credentials.
In theory they want you to use a 2FA authenticator for it so their protocol requires TOTP secrets and the like. In practice nothing stops you saving the seed to a file, so you can sign automatically.
Of course then you're reducing the security gained by the system. Your CI becomes a very weak point. But it does work.
The CAB Forum is well aware that people want to and can sign automatically. The purpose of the HSM is to fix revocation, not to require manual intervention for signing software.