FAQs

How to create a Code Signing Certificate with key attestation in Sectigo SCM

Updated on August 14, 2026

Overview

By the end of this article, you will have a working Code Signing Certificate request that uses key attestation in Sectigo Certificate Manager (SCM), submitted by an invited user and ready for issuance. Key attestation is proof, generated by the hardware that holds the key, that the private key was created inside a Hardware Security Module (HSM) and cannot be exported from it. The article explains what key attestation is, then covers the four stages in order: creating the certificate profile, creating the enrollment form and assigning it to an account, inviting the user who will submit the request, and submitting the Certificate Signing Request (CSR) with the attestation value through the enrollment form.

What is the key attestation?

Key attestation is evidence produced by a Hardware Security Module (HSM) or token confirming that a private key was generated inside that device and is not exportable. For code signing, the Certificate Authority (CA) uses this evidence to confirm the signing key is protected in hardware before it issues the certificate. In Sectigo Certificate Manager (SCM), attestation is supplied by the requester as a value submitted alongside the Certificate Signing Request (CSR) on the enrollment form.

Prerequisites

Confirm the following before you begin:

Administrator access to Sectigo Certificate Manager (SCM)
A Certificate Authority (CA) backend that supports code signing with key attestation
A certificate template that includes key attestation
The email address of the user who will submit the Certificate Signing Request (CSR) and attestation value
A Hardware Security Module (HSM) or token available to that user for key generation

Stage 1 — Create the Code Signing certificate profile

Create the profile that defines how Code Signing Certificates are issued:

Create a new certificate profile in Sectigo Certificate Manager (SCM).
Select Code Signing Certificate as the Certificate Type.

Figure 1: Certificate Type field configured as Code Signing Certificate during Code Signing certificate profile creation in Sectigo Certificate Manager (SCM)
Select a Certificate Authority (CA) backend that supports code signing with key attestation.

Figure 2: CA Backend selection during Code Signing certificate profile configuration. Choose a backend that supports key attestation requirements.
Select a certificate template that includes key attestation.

Figure 3: Choose a Code Signing certificate template with key attestation support to enable hardware-backed key validation during certificate issuance.
Assign the certificate terms available on this profile, then save.

Figure 4: Adding available certificate term options to the Code Signing certificate profile during configuration in Sectigo Certificate Manager (SCM).

Stage 2 — Create the Code Signing enrollment form

The enrollment form is the page the requester uses to submit their Certificate Signing Request (CSR) and attestation value:

Create a new enrollment form and confirm its type is Code Signing Certificate Enrollment Form.

Figure 5: Code Signing Certificate Enrollment Form selected during enrollment form creation to support CSR submission and key attestation-based certificate enrollment.
Generate a URL extension for the form.

Figure 6: Generating a URL extension for the Code Signing Certificate Enrollment Form to create a unique enrollment endpoint in Sectigo Certificate Manager (SCM).
Save the form.

Stage 3 — Assign the enrollment form to an account

The form must be linked to an account before invitations can use it:

Select the enrollment form you created, then click Account.

Figure 7: Access the Account settings for the enrollment form to configure the organization and department profile associated with Code Signing certificate requests.
Click to add the new account.

Figure 8: Use the Add (+) control to create and assign an account for the Code Signing Enrollment Form before configuring organization and department settings.
Configure the organization and department profile for that account. Select the account that holds the key attestation template.

Figure 9: Create and configure the enrollment form account by selecting the appropriate organization, department, and profile settings to support Code Signing certificate requests with key attestation.

Stage 4 — Invite the user who will submit the request

Send an invitation to the person who will provide the Certificate Signing Request (CSR) and attestation value:

In Sectigo Certificate Manager (SCM), go to Certificates > Code Signing Certificates.

Figure 10: Create and configure the enrollment form account by selecting the appropriate organization, department, and profile settings to support Code Signing certificate requests with key attestation.
Click Invitations in the top-right corner.

Figure 11: The Invitations section is used to send enrollment invitations to users who will submit a Certificate Signing Request (CSR) and key attestation for a Code Signing certificate.
Click the + icon.

Figure 12: Select the Add (+) icon in the Invitations page to create an enrollment invitation for a user who will provide the Certificate Signing Request (CSR) and key attestation required for Code Signing certificate issuance.
Enter the following details:
- Email — the address of the recipient who will provide the CSR and attestation value.
- Enrollment Endpoint — the enrollment form created in Stage 2.
- Account — this populates automatically from the selected enrollment endpoint. If it does not, select the account that holds the key attestation template.
Click Send.

Figure 13: Invitation configuration screen used to send a Code Signing certificate enrollment request. Provide the recipient email address, select the enrollment endpoint, confirm the account, and send the invitation to begin CSR and key attestation submission.

Stage 5 — Submit the CSR with attestation

These steps are performed by the invited recipient, using the link in the invitation email:

Open the invitation email received from the enrollment form and follow the enrollment link.

Figure 14: Open the enrollment invitation email and click Verify Email Address to begin the Code Signing certificate enrollment process.
Enter the certificate details: the certificate term, the certificate email (Subject Alternative Name, or SAN), first name, and last name.

Figure 15,16,17 & 18: the certificate term, the certificate email (Subject Alternative Name, or SAN), first name, and last name
Upload the Certificate Signing Request (CSR).

Figure 19: Click Upload CSR to upload the Certificate Signing Request (CSR) as part of the Code Signing certificate enrollment process.
Add the key attestation details: the attestation value, and the Hardware Security Module (HSM) type.

Figure 20 & 21: the attestation value, and the Hardware Security Module (HSM) type
Complete any custom fields marked as mandatory.

Figure 22: Enter values for all required custom fields before submitting the Code Signing certificate enrollment request
Accept the End User License Agreement (EULA).

Figure 23: Select the checkbox to confirm acceptance of the Sectigo Code Signing Certificate End User License Agreement (EULA) before submitting the enrollment request.
Submit the enrollment.

Figure 24: Click Submit to send the completed Code Signing certificate enrollment request

Verification

Confirm the request was submitted correctly:

In Sectigo Certificate Manager (SCM), go to Certificates > Code Signing Certificates and confirm the new request appears against the expected account and enrollment form.
Confirm the request shows the attestation value that the recipient submitted.
Confirm the invitation status has moved from pending to submitted.