← All apps

RemoteID

Luka Kuuhaku

Certisign cloud certificate driver for Tessera

Extension for Tessera →Part of the ICP-Brasil digital signature collection (10 apps) →

Runs with Tessera; the install command installs it too.

First time? Set up FlatPark →
SystemGPL-3.0-onlyv0.4.1

About

This package is maintained by RemoteID's developer. It installs RemoteID's official release build from its GitHub releases, unmodified. RemoteID is an independent open source project, not made or endorsed by Certisign.

RemoteID makes a Certisign RemoteID cloud certificate available on Linux as a token. Tessera loads it like any other driver, so browsers and document signers that use Tessera's tokens see the certificate and sign with it. The private key never leaves Certisign's servers; when the signing session has expired, a window asks for the code from the authenticator app.

  • Sign in to the RemoteID account from the RemoteID button in Tessera
  • Signs from browsers, PDF readers and document signers, with only Tessera running in the background
  • The command line inside Tessera's sandbox signs files and produces .p7s signatures
  • When something fails, remoteid diagnostico packs a log with no password, PIN or authenticator code, to attach to a bug report

The driver runs inside Tessera's sandbox with Tessera's permissions and has none of its own. It reaches Certisign's servers through Tessera's network access.

Logging in to websites with the certificate works over TLS 1.2 only: TLS 1.3 requires an RSA-PSS signature, which Certisign's service does not provide. Signing documents is not affected.

What's New

v0.4.1 · 2026-11-07

Keeps a log of what browsers and signers ask of the certificate, and adds the remoteid diagnostico command to collect it. First release for Tessera.

Full release notes →

Details

Developer
Luka Kuuhaku
License
GPL-3.0-only
Runtime
GNOME 51
Architectures
x86_64
Version
0.4.1 · 2026-11-07
Website
Homepage
Source
RemoteID
Packaging
flatpark/registry

Permissions

39 to review

Runs inside Tessera, with all of its permissions:

  • X11 windowing system

    Legacy display protocol; can observe input to other X11 windows

  • Network access

    Can reach the internet and local network

  • Files: xdg-run/tessera:create

  • Files: xdg-config/pkcs11:create

  • Files: ~/.var/app/org.gnome.Papers/config

  • Files: ~/.var/app/org.kde.okular/config

  • Files: ~/.var/app/org.mozilla.firefox/config/mozilla/firefox

  • Files: ~/.var/app/org.mozilla.firefox/.mozilla/firefox

  • Files: ~/.pki/nssdb

  • Files: ~/.var/app/org.chromium.Chromium/data/pki/nssdb

  • Files: ~/.var/app/com.brave.Browser/.pki/nssdb

  • Files: ~/.var/app/com.brave.Browser/data/pki/nssdb

  • Files: ~/.var/app/com.google.Chrome/.pki/nssdb

  • Files: ~/.var/app/com.google.Chrome/data/pki/nssdb

  • Files: ~/.var/app/com.microsoft.Edge/.pki/nssdb

  • Files: ~/.var/app/com.microsoft.Edge/data/pki/nssdb

  • Files: ~/.var/app/org.mozilla.thunderbird/.thunderbird

  • Files: ~/.var/app/org.mozilla.thunderbird/config/thunderbird

  • Files: ~/.var/app/org.mozilla.thunderbird_esr/.thunderbird

  • Files: ~/.var/app/org.mozilla.thunderbird_esr/config/thunderbird

  • Files: ~/.var/app/org.mozilla.Thunderbird/.thunderbird

  • Files: ~/.var/app/org.gnome.Evolution/data/pki/nssdb

  • Files: ~/.var/app/org.libreoffice.LibreOffice/config/libreoffice

  • Files: ~/.var/app/org.libreoffice.LibreOffice/data

  • Files: ~/.var/app/io.github.intoolswetrust.JSignPdf/config

  • Files: ~/.var/app/net.code_industry.MasterPDFEditor/config

  • Files: ~/.mozilla/firefox

  • Files: xdg-config/mozilla/firefox

  • Files: xdg-data/pki/nssdb

  • Files: ~/.pjeoffice-pro

  • Files: ~/.thunderbird

  • Files: xdg-config/thunderbird

  • Files: xdg-config/libreoffice

  • Files: xdg-data/flatpak/appstream:ro

  • Files: /var/lib/flatpak/appstream:ro

  • Files: xdg-data/flatpak/app:ro

  • Files: /var/lib/flatpak/app:ro

  • Files: xdg-data/flatpak/overrides:ro

  • Files: xdg-run/p11-kit/pkcs11

  • Inter-process communication

    Shares the IPC namespace with the host

  • Socket: pcsc

  • Talk to org.kde.StatusNotifierWatcher

  • Persistent storage: .config/serproid

  • Wayland display

  • GPU acceleration

Packaging

Unmodified

Runs the vendor's build as shipped — nothing added or changed.

What the levels mean →