ICP-Brasil digital signature
10 apps on FlatPark
Tools for signing with ICP-Brasil certificates on Linux, including on immutable systems where vendor driver packages can't be installed. A3 tokens and smart cards need the vendor's PKCS#11 driver, pcscd and p11-kit. Tessera runs the drivers inside its own sandbox and shares every token over the p11-kit socket, and the sandboxed signers below reach it there.
How to set up an A3 token with Tessera →
Copied! Paste it into a terminal and press Enter to install.
Needs the FlatPark remote. Set it up →
These are community packages of the official upstream builds, maintained by FlatPark independently and unaffiliated with their developers.
Token drivers
Install Tessera first and turn on the host's p11-kit server once (systemctl --user enable --now p11-kit-server.socket). OpenSC is built in; each vendor's driver is a separate extension, so install only the one your token needs (Tessera's window tells you which), then use Restart Tessera. Tessera can also set up browsers, mail clients and PDF signers to use the tokens.
Tessera
Share smart card and token drivers with your other apps
SafeSign IC
SafeSign IC token driver for Tessera
SafeNet Authentication Client
SafeNet eToken and IDPrime driver for Tessera
SerproID
Serpro cloud certificate driver for Tessera
RemoteID
Certisign cloud certificate driver for Tessera
Web signers
Browser plugins that sign on websites: Lacuna Web PKI, Softplan WebSigner (used by e-SAJ) and Certisign WebSigner. Each is an extension of Tessera that the Flatpak browsers (Firefox, Chromium, Chrome, Edge, Brave) run themselves; Tessera's Web signers section shows the one command each browser needs. Then install the plugin from the browser's store and tick its SafeSign option once.
Signers
PJeOffice Pro signs in the PJe court system; Assinador Serpro is Serpro's signer. Both already have access to the p11-kit socket and use the token Tessera serves, with no driver installed on the host.