← All apps

Certisign WebSigner

CertisignProprietary

Certisign WebSigner for Tessera's tokens in Flatpak browsers

Extension for Tessera →Part of the ICP-Brasil digital signature collection (10 apps) →

Runs with Tessera; the install command installs it too.

First time? Set up FlatPark →
SystemProprietaryv2.9.5

About

WebSigner is the program behind Certisign's browser plugin, which Certisign's signing portals use to sign with a digital certificate.

With this extension, the Flatpak browsers Tessera sets up (Firefox, Chromium, Google Chrome, Microsoft Edge and Brave) run the plugin's program inside their own sandbox, and it signs with Tessera's tokens through the system's p11-kit server: no distrobox, no packages installed on the system.

Tessera does not run it. After installing, restart Tessera: its Web signers section shows, for each browser, the one command that lets the browser start the program (run once in a terminal), and what to tick in the plugin's settings.

This extension installs the program from the vendor's official Linux package, downloaded at install time and checked against a pinned checksum. Only its files are taken: no install script runs. Certisign WebSigner is closed source and not made or endorsed by Tessera's author.

Details

Developer
Certisign
License
Proprietary
Runtime
GNOME 51
Architectures
x86_64
Version
2.9.5 · 2026-11-08
Website
Homepage
Source
Certisign WebSigner
Packaging
flatpark/registry

Permissions

39 to review

Runs inside Tessera, with all of its permissions:

  • X11 windowing system

    Legacy display protocol; can observe input to other X11 windows

  • Network access

    Can reach the internet and local network

  • Files: xdg-run/tessera:create

  • Files: xdg-config/pkcs11:create

  • Files: ~/.var/app/org.gnome.Papers/config

  • Files: ~/.var/app/org.kde.okular/config

  • Files: ~/.var/app/org.mozilla.firefox/config/mozilla/firefox

  • Files: ~/.var/app/org.mozilla.firefox/.mozilla/firefox

  • Files: ~/.pki/nssdb

  • Files: ~/.var/app/org.chromium.Chromium/data/pki/nssdb

  • Files: ~/.var/app/com.brave.Browser/.pki/nssdb

  • Files: ~/.var/app/com.brave.Browser/data/pki/nssdb

  • Files: ~/.var/app/com.google.Chrome/.pki/nssdb

  • Files: ~/.var/app/com.google.Chrome/data/pki/nssdb

  • Files: ~/.var/app/com.microsoft.Edge/.pki/nssdb

  • Files: ~/.var/app/com.microsoft.Edge/data/pki/nssdb

  • Files: ~/.var/app/org.mozilla.thunderbird/.thunderbird

  • Files: ~/.var/app/org.mozilla.thunderbird/config/thunderbird

  • Files: ~/.var/app/org.mozilla.thunderbird_esr/.thunderbird

  • Files: ~/.var/app/org.mozilla.thunderbird_esr/config/thunderbird

  • Files: ~/.var/app/org.mozilla.Thunderbird/.thunderbird

  • Files: ~/.var/app/org.gnome.Evolution/data/pki/nssdb

  • Files: ~/.var/app/org.libreoffice.LibreOffice/config/libreoffice

  • Files: ~/.var/app/org.libreoffice.LibreOffice/data

  • Files: ~/.var/app/io.github.intoolswetrust.JSignPdf/config

  • Files: ~/.var/app/net.code_industry.MasterPDFEditor/config

  • Files: ~/.mozilla/firefox

  • Files: xdg-config/mozilla/firefox

  • Files: xdg-data/pki/nssdb

  • Files: ~/.pjeoffice-pro

  • Files: ~/.thunderbird

  • Files: xdg-config/thunderbird

  • Files: xdg-config/libreoffice

  • Files: xdg-data/flatpak/appstream:ro

  • Files: /var/lib/flatpak/appstream:ro

  • Files: xdg-data/flatpak/app:ro

  • Files: /var/lib/flatpak/app:ro

  • Files: xdg-data/flatpak/overrides:ro

  • Files: xdg-run/p11-kit/pkcs11

  • Inter-process communication

    Shares the IPC namespace with the host

  • Socket: pcsc

  • Talk to org.kde.StatusNotifierWatcher

  • Persistent storage: .config/serproid

  • Wayland display

  • GPU acceleration

Packaging

Modified

  • Changes the vendor's files

    The program opens its dialogs from a fixed folder, /opt/certisign-websigner/res, which a browser's sandbox does not have. The seven dialog paths in the program are rewritten in place to res/, and it runs from the extension's own folder, where res/ is. The package's native messaging manifests and install scripts are not used.

  • Injects code into the app

    A small PKCS#11 module, which the program loads under the name its plugin's SafeSign option asks for, passes every call to the runtime's p11-kit client, so the program reaches Tessera's tokens; it leaves out the slots of the system's trust store, on which the program crashes.

What the levels mean →