---
title: "Rext Desktop"
description: "Rext Desktop: white-label Windows and macOS application that lets the applications on the computer sign with cloud certificates, through the system certificate store or a PKCS#11 module."
canonical: "https://docs.lacunasoftware.com/en-us/articles/rext-desktop"
locale: "en"
product: "Rext Desktop"
last_updated: "2026-10-14"
---

# Rext Desktop

Rext Desktop makes cloud certificates available to the applications on the user's computer. The
private keys never leave the cloud HSM: when an application signs with one of these certificates,
Rext Desktop asks for the authorization on the mobile app and returns the signature computed in
the cloud.

Rext Desktop is distributed under each customer's brand, with its own name, sign-in and update
server. The brands currently published are:

| Brand | App name | PKCS#11 module |
|---|---|---|
| Code100 | Code100 Desktop | `code100-p11` |

- [Changelog](https://docs.lacunasoftware.com/en-us/articles/rext-desktop/changelog)

## Requirements

- **Windows** 10 or later, x64 or ARM64, with the brand's **provider** installed (see below).
- **macOS** 10.15 or later, Intel or Apple Silicon.
- The brand's **mobile app**, to authorize signatures.

## Installation

**Windows.** Run the app installer. On first launch, the app checks whether the provider is
installed and, if not, offers its installer. The provider installs the components that the other
applications load — the Key Storage Provider and the PKCS#11 module — into the Windows system
folders, so it requires administrator rights.

**macOS.** Open the DMG and drag the app to the Applications folder.

The app updates automatically; the update dialog can be declined.

## Using the certificates

The user signs in with the brand's account, then chooses which certificates to install. The app
must be running to sign; when an application requests a signature and the app is not running, it
is started automatically.

Each signature is authorized on the mobile app, by scanning a QR code. On the app's
**Settings** page, the user chooses how often to authorize: once per session, or every
signature. The interface is available in Portuguese, English and Spanish.

### Applications that use the system certificate store

Most applications — browsers, document signers, applications built on Windows CNG or on the macOS
keychain — need no configuration: the installed certificates show up in the system certificate
store like any other certificate.

- **Windows**: through the brand's Key Storage Provider (CNG KSP).
- **macOS**: through a CryptoTokenKit extension, which exposes the certificates in the keychain.

### Applications that use PKCS#11

Applications that load a PKCS#11 module instead of using the system store, such as Firefox and
Java (SunPKCS11), must be pointed at the module by its full path. For Code100 Desktop:

| System | Module path |
|---|---|
| Windows | `C:\Windows\System32\code100-p11.dll` |
| macOS | `/Applications/Code100 Desktop.app/Contents/Resources/libcode100-p11.dylib` |

For other brands, replace the module name and the app name. On Windows, the module is installed
for both 64-bit and 32-bit applications, so the bare name (`code100-p11.dll`) also works.

**Firefox**: open **Settings → Privacy & Security → Security Devices → Load**, and enter the module
path.

**Java**: create a SunPKCS11 configuration file that points to the module, for example:

```text
name = Code100
library = C:/Windows/System32/code100-p11.dll
```

The module is read-only and scoped to signing: it lists the installed certificates and their keys
and signs with RSA (`CKM_RSA_PKCS`). It asks for no PIN, since each signature is authorized on the
mobile app.