Rext Desktop

Rext Desktop makes cloud certificates available to the applications on the user's computer. The private keys never leave the cloud HSM: when an application signs with one of these certificates, Rext Desktop asks for the authorization on the mobile app and returns the signature computed in the cloud.

Rext Desktop is distributed under each customer's brand, with its own name, sign-in and update server. The brands currently published are:

Brand	App name	PKCS#11 module
Code100	Code100 Desktop	code100-p11

• Changelog

Requirements

• Windows 10 or later, x64 or ARM64, with the brand's provider installed (see below).
• macOS 10.15 or later, Intel or Apple Silicon.
• The brand's mobile app, to authorize signatures.

Installation

Windows. Run the app installer. On first launch, the app checks whether the provider is installed and, if not, offers its installer. The provider installs the components that the other applications load — the Key Storage Provider and the PKCS#11 module — into the Windows system folders, so it requires administrator rights.

macOS. Open the DMG and drag the app to the Applications folder.

The app updates automatically; the update dialog can be declined.

Using the certificates

The user signs in with the brand's account, then chooses which certificates to install. The app must be running to sign; when an application requests a signature and the app is not running, it is started automatically.

Each signature is authorized on the mobile app, by scanning a QR code. On the app's Settings page, the user chooses how often to authorize: once per session, or every signature. The interface is available in Portuguese, English and Spanish.

Applications that use the system certificate store

Most applications — browsers, document signers, applications built on Windows CNG or on the macOS keychain — need no configuration: the installed certificates show up in the system certificate store like any other certificate.

• Windows: through the brand's Key Storage Provider (CNG KSP).
• macOS: through a CryptoTokenKit extension, which exposes the certificates in the keychain.

Applications that use PKCS#11

Applications that load a PKCS#11 module instead of using the system store, such as Firefox and Java (SunPKCS11), must be pointed at the module by its full path. For Code100 Desktop:

System	Module path
Windows	C:\Windows\System32\code100-p11.dll
macOS	/Applications/Code100 Desktop.app/Contents/Resources/libcode100-p11.dylib

For other brands, replace the module name and the app name. On Windows, the module is installed for both 64-bit and 32-bit applications, so the bare name (code100-p11.dll) also works.

Firefox: open Settings → Privacy & Security → Security Devices → Load, and enter the module path.

Java: create a SunPKCS11 configuration file that points to the module, for example:

name = Code100
library = C:/Windows/System32/code100-p11.dll

The module is read-only and scoped to signing: it lists the installed certificates and their keys and signs with RSA (CKM_RSA_PKCS). It asks for no PIN, since each signature is authorized on the mobile app.