Cause and solution: “Application is not signed” when installing a custom Industrial Edge app

The warning “Application is not signed” indicates that the Industrial Edge Device (IED) identifies the application as unsigned. The warning does not, by itself, mean that the application is defective.

When a custom application is packaged using the Industrial Edge App Publisher (IEAP) and pushed directly to Industrial Edge Management (IEM), the resulting application should not be assumed to be signed automatically. Siemens provides an App Signing Service through the Industrial Edge Hub (IE Hub) release workflow.

Recommended solution: Sign the app through Industrial Edge Hub

1. Prepare the application package. Build and export your custom application as an .app file using your supported Industrial Edge App Publisher workflow.
2. Upload the app to IE Hub. In IE Hub, create an application version and upload the .app file. Siemens explicitly allows an unsigned app file to be uploaded for signing during the subsequent activation process. Complete the required checks, including the app file's virus scan.
3. Activate the version and complete the private release. Follow the documented IE Hub product/version management procedure. During activation, IE Hub requests the App Signing Service to sign unsigned application versions. The process may take up to five minutes. If signing and private release complete successfully, the version status becomes Privately released, and the signed-version indicator is displayed.
4. Transfer the signed version to IEM. Use the transfer action associated with the privately released version to transfer it to an IEM instance within the same IE Hub organization.
5. Install the application on the IED again. Check whether the unsigned-application warning has disappeared. Other installation warnings, if present, need to be evaluated separately.

Optional: Validate the app package

The current Siemens IECTL command for validating an .app file is:

iectl publisher standalone-app validate --path /path/to/application.app

This validates the app file and its digests, checks the signature if the app is signed, and performs other package validation checks. It is a validation command, not a command that signs an unsigned application.

Important note

The App Installation Policy on an IED evaluates signature state and other security-relevant application properties. Depending on the configured policy, a violation can result in a warning or a blocked installation. Do not disable or weaken a mandatory security policy merely to bypass the warning.

Official Siemens references

1. Creating a device application version — uploading an unsigned .app file and preparing a version for activation.
2. Privately and publicly releasing an app version — App Signing Service, signing status, signed-certificate location and transfer to IEM.
3. IECTL: Validate an app file — current package-validation command.
4. App Installation Policy — signature checks and installation-policy behavior.

Hi Rohit,

The warning “Application is not signed” appears because the custom application package has not been signed through the Industrial Edge app-signing process. Uploading an application to IEM using IE App Publisher (IEAP) does not necessarily sign it.

Recommended solution: Sign the application through IE Hub

1. Export the application: Use IE App Publisher to generate the .app package and ensure its metadata and version are correct.
2. Upload it to IE Hub: Create or select the corresponding device application in IE Hub and upload the .app package.
3. Create a private release: In IE Hub, select the uploaded version and choose Private release. Confirm the application details and start the release process.
4. Wait for signing to complete: IE Hub validates the package and requests signing through the App Signing Service. Wait until the version status shows Privately released. If the process fails, review the rejection reason or notification before proceeding.
5. Transfer the signed version to IEM: Use the transfer action for the privately released version to send it to your IEM instance.
6. Install the application: Install that version on your Industrial Edge Device and verify the signature status in the installation dialog.

Why this works

Industrial Edge's signing process verifies the integrity and authenticity of the application package. It includes signing the container images and signing the package's digests.json file, with the signature stored in digests.p7s.

If you upload an unsigned custom package directly to IEM, the installation dialog can report that the application is not signed.

Important: If this is only a development or test application, IEM may permit installation while displaying a warning, depending on its security configuration. For production, use the supported signing and verification workflow rather than treating the warning as harmless.

Official Siemens documentation:

• Industrial Edge App Signing Process
• Privately and Publicly Releasing an App Version

Hope this helps! If you find this answer helpful, please mark it as the accepted answer.