Create Code Signing key pairs and certificates

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Create two key pairs to signed certificates to establish trust between your protected and trusted instances.

    To establish trust between your instances, you must create a key pair and certificate for each of the cm_code_attest and cm_code_signing cryptographic modules.

    Creating key pairs and certificates is done using a cryptographic tool installed on your local device, such as the OpenSSL tool. For more information on this tool, see https://www.openssl.org. If your organization uses other cryptographic tools, such as LibreSSL or GnuTLS, refer to the documentation for those products for similar steps.

    Key pair specifications

    The key pairs you create must meet these requirements.

    Type RSA
    Key length 4096
    Signing algorithm RSASSA_PKCS1_V1_5_SHA_512

    Certificate specifications

    Certificates must be signed by a public certificate authority.