Home / Services / Certificates & signing

SSL/TLS · Code signing · Document signing · Signing automation

Certificates, and the tools to use them properly.

Certificates are where One Sign began. We supply SSL/TLS, code-signing and document-signing certificates from GlobalSign and Sectigo, help with validation and installation, and make the software that lets you sign automatically with the hardware tokens they are issued on.

How certificates are trusted, and how signing works

Certificate chain

  1. Root CAAlready trusted by browsers and operating systems
  2. Issuing CAGlobalSign, Sectigo or the One Sign–branded issuing CA
  3. Your certificateFor your website, mail server, software or documents
  4. Trusted connectionVisitors and systems can verify who they are dealing with

Signing with OneSigner

  1. Your file or buildPDF, EXE, DLL or MSI from your systems
  2. OneSigner serviceAPI, watched folder or build pipeline
  3. USB token signsThe private key never leaves the token
  4. Signed fileReturned to your system, ready to publish

SSL/TLS certificates

Certificates for websites, mail servers and applications

We supply certificates at each validation level and help you choose between them, complete the validation, and install the result. For clients on our hosting, installation and renewal are part of the service.

  • DV (domain validated) – confirms control of the domain
  • OV (organisation validated) – also confirms the registered organisation
  • EV (extended validation) – the most thorough organisation checks
  • Wildcard certificates for all sub-domains of a domain
  • Multi-domain certificates covering several names

Certificates are issued by GlobalSign and Sectigo, including our One Sign–branded issuing CA. Browse certificates

Signing certificates

Code-signing and document-signing certificates

Code-signing certificates let Windows and users verify who published a piece of software and that it has not been changed. Document-signing certificates put a verifiable digital signature on PDF files. Under current CA rules the private keys for these are kept on a hardware token or in an HSM.

  • OV and EV code-signing certificates for Windows software
  • Document-signing certificates for PDF signatures
  • Delivery on a USB hardware token where the CA requires it
  • Help through organisation validation and token setup

To check the signatures in a PDF you have received, use our free PDF signature checker.

Signing automation

OneSigner: automated signing with your own tokens

A certificate on a USB token normally means signing by hand, on one machine. OneSigner is our Windows service and API that turns that machine into a signing service for your systems and your team, while the private key stays on the token and files stay on your own infrastructure.

  • PDF signing through a REST API, watched folders and a browser portal
  • Windows code signing from build pipelines, through an Azure Key Vault–compatible signing proxy
  • Works with YubiKey, SafeNet, ePass and other tokens that Windows recognises
  • eSign portal for sending documents to several signers in order
OneSigner at onesign.sg

Questions

Frequently asked

Which certificate authorities does One Sign supply?

SSL/TLS certificates from GlobalSign, Sectigo and DigiCert, and code-signing and document-signing certificates from GlobalSign, Sectigo and SSL.com.

How long is an SSL certificate valid?

Publicly trusted SSL/TLS certificates can be valid for at most 200 days since 15 March 2026. A one-year subscription includes the replacement certificate at no extra cost.

Can document or code signing be automated?

Yes. OneSigner signs PDFs and Windows software automatically with the certificate kept on a USB hardware token, through watched folders or an API.

Need a certificate, or help using one?

Tell us what it is for: a website, software you publish, or documents you sign.

Email sales@onesign.sg