License & Signing Security
A signing server is security-critical infrastructure, so OneSigner's licensing is built with the same discipline as its signatures. This page explains the mechanisms — useful for security reviews and for understanding the free certificate-bundled license.
Cryptographically Signed License Keys
- Every key carries an ECDSA P-256 signature over its payload (plan, features, binding, expiry). Tampering with any field invalidates the key.
- Validation is offline — no license server in your signing path.
Hardware Binding
- Purchased licenses can be bound to a machine's Hardware ID (shown on the License tab). The key simply refuses to validate elsewhere.
- Transfers are handled by re-issue through support.
Automatic Revocation (CRL) Checks
- Once every 24 hours, OneSigner checks its license against the revocation list at
onesign.sg— refunded, chargeback or abused keys stop working automatically. - Offline tolerance: a 7-day grace period, so a network outage never halts your signing pipeline overnight.
Thumbprint-Locked Free Licenses
When you buy a signing certificate through OneSigner Certificates, a free OneSigner license is included. To prevent abuse, that license embeds the certificate's SHA1 thumbprint allowlist inside the signed key:
- Code signing is permitted only with the certificate(s) on the allowlist; other certificates get a 403. PDF signing is unaffected.
- Because the allowlist lives inside the cryptographically signed key, it cannot be edited out.
- Configure your code-signing profile to select the certificate by SHA1 thumbprint — selection by subject name or PFX file cannot be matched against the allowlist and is refused (fail-closed).
- Regular purchased licenses have no allowlist and sign with any certificate.
The same allowlisting is also available server-side for AKV proxy mappings — a defence-in-depth option for shared signing servers.
Custom Public Domain per License
Licenses can include a public HTTPS endpoint for your server via Cloudflare Tunnel — a stable domain for your API, OneSignTool clients and eSign signers, with no inbound firewall ports. Configure it in the Custom Domain tab; contact support to set up a fully custom domain name for your license.
What OneSigner Never Does
- Your documents and binaries are never sent to us — signing is local to your server (and with OneSignerBridge, local to the signer's machine).
- Private keys stay in your hardware tokens; OneSigner has no key escrow, no cloud HSM, no telemetry of signed content.
- The only outbound calls are license CRL checks and the timestamp servers you configure.