---
title: "Cloud certificate services - PKI Express"
description: "Configuring PKI Express to sign with cloud digital certificates (ITI specifications), on the preconfigured services or on other services."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-express/config/trust-services"
locale: "en"
product: "PKI Express"
last_updated: "2026-10-12"
---

# Cloud certificate services - PKI Express

PKI Express supports signatures with cloud digital certificates, provided by cloud service providers that follow the
specifications of ITI (Instituto Nacional de Tecnologia da Informação, the ICP-Brasil authority).

## Preconfigured services

The following services are preconfigured by default:

* BirdID (SOLUTI)
* NeoID (SERPRO)
* RemoteID (CERTISIGN)
* SafeID (SAFEWEB)
* VIDaaS (VALID)

To use one of these preconfigured services, you only need to set its `clientId` and `clientSecret`:

```sh
pkie config --set trustServices:<service>:clientId=<value>
pkie config --set trustServices:<service>:clientSecret=<value>
```

For instance:

```sh
pkie config --set trustServices:BirdID:clientId="00000000000000"
pkie config --set trustServices:BirdID:clientSecret="xxx00xxXXXXxx0x"
```

## Other services

To use a service that is not preconfigured, you must also set the service `endpoint`:

```sh
pkie config --set trustServices:<service>:endpoint=<value>
pkie config --set trustServices:<service>:clientId=<value>
pkie config --set trustServices:<service>:clientSecret=<value>
```

For instance:

```sh
pkie config --set trustServices:birdIdHml:endpoint="https://apihom.birdid.com.br/"
pkie config --set trustServices:birdIdHml:clientId="00000000000000"
pkie config --set trustServices:birdIdHml:clientSecret="xxx00xxXXXXxx0x"
```

Services that are not preconfigured also accept the following optional settings:

* The service provider:
    ```sh
    pkie config --set trustServices:<service>:provider=<value>
    ```

* The URL of the service logo:
    ```sh
    pkie config --set trustServices:<service>:badgeUrl=<URL>
    ```

* The error handling strategy, taken from one of the preconfigured services:
    ```sh
    pkie config --set trustServices:<service>:protocolVariant=<service>
    ```

## Timeout

To set the timeout for discovering certificates on the providers, use the command below:

```sh
pkie config --set trustServicesDiscoveryTimeout=<value>
```

**Demos and samples**

- Live demo: [Sign a PDF with your cloud certificate](https://try.lacunasoftware.com/en/pki-suite/sign-with-cloud-certificate)
- Sign a PDF with a cloud certificate (OAuth flow) using PKI Express: [Java](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/java/springmvc/src/main/java/com/lacunasoftware/pkisuite/controller/PadesCloudOauthExpressController.java) · [Node.js](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/nodejs/expressmvc/routes/pades-cloud-oauth-express.js) · [PHP](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/php/plain/public/pades-cloud-oauth-express/index.php) · [Python](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/python/flask/sample/views/pades_cloud_oauth_express.py) · [Ruby](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/ruby/rails/app/controllers/pades_cloud_oauth_express_controller.rb)
- Sign a PDF with a cloud certificate (password flow) using PKI Express: [Java](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/java/springmvc/src/main/java/com/lacunasoftware/pkisuite/controller/PadesCloudPwdExpressController.java) · [Node.js](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/nodejs/expressmvc/routes/pades-cloud-pwd-express.js) · [PHP](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/php/plain/public/pades-cloud-pwd-express/index.php) · [Python](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/python/flask/sample/views/pades_cloud_pwd_express.py) · [Ruby](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/ruby/rails/app/controllers/pades_cloud_pwd_express_controller.rb)
- Sign a file with CAdES and a cloud certificate (OAuth flow) using PKI Express: [Java](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/java/springmvc/src/main/java/com/lacunasoftware/pkisuite/controller/CadesCloudOauthExpressController.java)
- Sign an XML document with a cloud certificate (OAuth flow) using PKI Express: [Node.js](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/nodejs/expressmvc/routes/xml-cloud-oauth-express.js)
- Authenticate with a cloud certificate (OAuth flow) using PKI Express: [Java](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/java/springmvc/src/main/java/com/lacunasoftware/pkisuite/controller/AuthenticationCloudExpressController.java)