[GH-ISSUE #1726] Signing transport support for AWS KMS #495

Open
opened 2026-02-26 18:47:17 +03:00 by kerem · 1 comment
Owner

Originally created by @dev2adventure on GitHub (Mar 26, 2025).
Original GitHub issue: https://github.com/documenso/documenso/issues/1726

Feature Description

Support to use AWS KMS (https://aws.amazon.com/kms/) as signing transport adapter when signing pdf documents instead of using a local private key file.

Use Case

Using AWS KMS as a signing transport for a self-hosted eSign solution allows secure, HSM-backed digital signing without exposing private keys. It ensures compliance and auditability through CloudTrail logging while offloading cryptographic operations to a secure managed service.

Proposed Solution

A signing transport adapter for Google Cloud's equivalent already exists so I imagine it's roughly the same flow.

Alternatives (optional)

No response

Additional Context

No response

Please check the boxes that apply to this feature request.

  • I have searched the existing feature requests to make sure this is not a duplicate.
  • I have provided a detailed description of the requested feature.
  • I have explained the use case or scenario for this feature.
  • I have included any relevant technical details or design suggestions.
  • I understand that this is a suggestion and that there is no guarantee of implementation.
  • I want to work on creating a PR for this issue if approved
Originally created by @dev2adventure on GitHub (Mar 26, 2025). Original GitHub issue: https://github.com/documenso/documenso/issues/1726 ### Feature Description Support to use AWS KMS (https://aws.amazon.com/kms/) as signing transport adapter when signing pdf documents instead of using a local private key file. ### Use Case Using AWS KMS as a signing transport for a self-hosted eSign solution allows secure, HSM-backed digital signing without exposing private keys. It ensures compliance and auditability through CloudTrail logging while offloading cryptographic operations to a secure managed service. ### Proposed Solution A signing transport adapter for Google Cloud's equivalent already exists so I imagine it's roughly the same flow. ### Alternatives (optional) _No response_ ### Additional Context _No response_ ### Please check the boxes that apply to this feature request. - [x] I have searched the existing feature requests to make sure this is not a duplicate. - [x] I have provided a detailed description of the requested feature. - [x] I have explained the use case or scenario for this feature. - [x] I have included any relevant technical details or design suggestions. - [x] I understand that this is a suggestion and that there is no guarantee of implementation. - [ ] I want to work on creating a PR for this issue if approved
Author
Owner

@github-actions[bot] commented on GitHub (Mar 26, 2025):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

<!-- gh-comment-id:2755765066 --> @github-actions[bot] commented on GitHub (Mar 26, 2025): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/documenso#495
No description provided.