{
    // The Kestrel HTTP Server configuration (https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/endpoints?view=aspnetcore-6.0)
    "Kestrel": {
        "Endpoints": {
            "Http": {
                "Url": "http://localhost:5000"
            }
        }
    },
    "SigningServer": {
        // The directory where the server will put temporarily the files during signing
        "WorkingDirectory": "C:\\SigningServer\\WorkingDirectory",
        // A RFC-3161 compliant timestamping server which should be used. 
        "TimestampServer": "http://timestamp.digicert.com",
        // A fallback Authenticode timestamping server for SHA1 based signing
        "Sha1TimestampServer": "https://timestamp.sectigo.com",
        // The interval in which the HSM certificates should be reloaded
        // to avoid unexpected  
        "HardwareCertificateUnlockIntervalInSeconds": 3600,
        // The maximum degree of parallelism allowed per individual client.
        "MaxDegreeOfParallelismPerClient": 4,
        // An array of certificates which should be loaded and made available
        "Certificates": [
            // Example for a certificate from the local windows certificate store
            {
                // Very basic security and certificate selection mechanism
                // Can be removed or left empty for the default certificate
                // which should be used in case the client does not supply credentials.
                // There can only be one certificate without username and password 

                "Username": "", // The plain text username to use this certificate
                "Password": "", // The plain text password to use this certificate

                "Local": {
                    "Thumbprint": "", // The thumbprint of the certificate to load
                    "StoreName": "", // The name of the certificate store to access (AddressBook, AuthRoot, CertificateAuthority, Disallowed, My, Root, TrustedPeople, TrustedPublisher)
                    "StoreLocation": "", // The location of the store (CurrentUser, LocalMachine)
                    "TokenPin": ""  // The pin to unlock the hardware token (holding EV certificates)
                                    // The pin is encrypted, obtain the value to put here with 
                                    // SigningServer.exe -encode TokenPinHere
                                    // is is protected with the Windows DPAPI
                }
            },
            // Example for a certificate from an Azure KeyVault
            {
                // Same as for local certificates
                "Username": "azure-keyvault",
                "Password": "azure-keyvault",

                // Azure specific configuration
                "Azure": {
                    "KeyVaultUrl": "", // The url to the azure keyvault like https://weu-000-keyvaultname.vault.azure.net/
                    "TenantId": "6333e2e8-47e9-46c1-ab8a-c9882a843742", // The ID of the tenant for accessing the keyvault
                    "CertificateName": "MyCodeSigningCert", // The name of the certificate in the key vault
                    "ClientId": "", // The client id for accessing the Key Vault (OAuth Client Credentias Grant flow)
                    "ClientSecret": "", // The client secret for accessing the Key Vault (OAuth Client Credentias Grant flow)
                    "ManagedIdentity": false // Whether to attempt using a managed identity for authentication
                }
            }
        ]
    }
}

{
    // The url where the signing server is hosted.
    "SigningServer": "http://hostname:port/",
    // The username and password to use for connecting to the server
    // and select the certificate
    "Username": "",
    "Password": "",

    // A flag indicating whether existing signatures should be overwritten
    "OverwriteSignatures": false,
    // Whether to accept existing signatures on the files or whether
    // the client should fail on files with existing signatures.
    "IgnoreExistingSignatures": false,
    // Whether to accept files which are not supported or whether
    // the client should fail on files which are not supported.
    "IgnoreUnsupportedFiles": false,
    // The maximum timeout before giving up on signing the file (in seconds)
    "Timeout": 300,
    // The hash algorithm to use when signing the file.
    // Supported algorithms might depend on the certificates used and 
    // the file formats (typical values: SHA1, SHA256, SHA386, SHA512)
    "HashAlgorithm": "SHA256",
    // How often to retry the signing operation until giving up. 
    "Retry": 1
}