SafeID Desktop
SafeID Desktop makes SafeID cloud certificates available to the applications on the user's computer. The private keys never leave the SafeID cloud HSM: when an application signs with one of these certificates, SafeID Desktop asks for the authorization on the SafeID mobile app and returns the signature computed in the cloud.
Requirements
- Windows 10 or later, x64 or ARM64, with SafeID Desktop Provider installed (see below).
- macOS 10.15 or later, Intel or Apple Silicon.
- The SafeID mobile app, to authorize signatures.
Download
Use the production package with the SafeID production environment, and the homologation package only to test against the SafeID homologation environment. The changes of each version are in the changelog.
Installation
Windows. Run the SafeID Desktop installer. On first launch, the app checks whether SafeID Desktop Provider is installed and, if not, downloads its installer for the system architecture. SafeID Desktop Provider installs the components that the other applications load — the Key Storage Provider and the PKCS#11 module — into the Windows system folders, so it requires administrator rights.
macOS. Open the DMG and drag SafeID Desktop to the Applications folder. If the app is started from the DMG, it moves itself to the Applications folder.
Both versions update automatically. On Windows, the app also checks the SafeID Desktop Provider version on startup and asks for its update when needed.
Using the certificates
After signing in, the user chooses which SafeID certificates to install. SafeID Desktop must be running to sign; when an application requests a signature and the app is not running, it is started automatically.
Applications that use the system certificate store
Most applications — browsers, document signers, applications built on Windows CNG or on the macOS keychain — need no configuration: the installed certificates show up in the system certificate store like any other certificate.
- Windows: through the SafeID Key Storage Provider (CNG KSP).
- macOS: through a CryptoTokenKit extension, which exposes the certificates in the keychain.
Applications that use PKCS#11
Applications that load a PKCS#11 module instead of using the system store, such as Firefox and Java (SunPKCS11), must be pointed at the SafeID PKCS#11 module by its full path:
| System | Module path |
|---|---|
| Windows | C:\Windows\System32\safeid-p11.dll |
| macOS | /Applications/SafeID Desktop.app/Contents/Resources/libsafeid-p11.dylib |
On Windows, the module is installed for both 64-bit and 32-bit applications, so the bare name
safeid-p11.dll also works.
Firefox: open Settings → Privacy & Security → Security Devices → Load, and enter the module path.
Java: create a SunPKCS11 configuration file that points to the module, for example:
name = SafeID
library = C:/Windows/System32/safeid-p11.dll
The module is read-only and scoped to signing: it lists the installed certificates and their keys
and signs with RSA (CKM_RSA_PKCS). It asks for no PIN, since each signature is authorized on the
SafeID mobile app.