Topaz Signature Pads in Kipu on Windows 11

The short version

Five links in the chain: the pad, the SigWeb service, an HTTPS call to tablet.sigwebtablet.com:47290, the Kipu page, and Kipu's server parsing the string it gets. One of the two problems below is the browser refusing to make that call. The other is the string.

Both fixes are one line. If the machine is already built, do those two and stop reading.

Step 1

Install SigWeb

Kipu drives Topaz pads through SigWeb, a small Windows service that owns the USB device and answers HTTP requests from the browser. No Chrome extension, nothing to add to an extension allowlist. If a guide tells you otherwise, it's describing a different vendor.

Enable .NET Framework 3.5 First

The Topaz installer wants it, and Windows 11 doesn't ship with it turned on. From an administrator PowerShell window:

Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -NoRestart

That pulls from Windows Update, so the machine needs internet and it'll sit there a few minutes. Behind a network that blocks it, DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /Source:D:\sources\sxs works off mounted install media.

Run the Installer

Download sigweb.exe from Topaz and run it as administrator. Topaz doesn't publish silent-install switches, so this is a click-through wizard. Take the defaults. They install the service, add the hosts entry, and drop the certificate covered in step 3.

Plug the pad in after the install finishes, then check that the service registered:

Get-Service | Where-Object { $_.DisplayName -match 'SigWeb' } | Format-List Name, DisplayName, Status, StartType

Step 2

Make the Service Start on Its Own

The person using this machine every day is probably a standard user with no rights to start services. Set SigWeb to Automatic so the pad is live before anyone logs in.

$svc = Get-Service | Where-Object { $_.DisplayName -match 'SigWeb' } | Select-Object -First 1
sc.exe config $svc.Name start= auto
Start-Service $svc.Name

Mind the space after start=. sc.exe is fussy about it and prints the usage text instead of doing anything.

Step 3

Understand the Hostname Trick

An HTTPS page can't make plain HTTP requests to your machine; the browser kills it as mixed content. Topaz gets around this in a way you should know about, because otherwise you'll spend an hour hunting a certificate problem that isn't there.

The installer adds a line to C:\Windows\System32\drivers\etc\hosts pointing tablet.sigwebtablet.com at 127.0.0.1, and ships a real CA-issued certificate for that name. So the browser makes an ordinary, fully valid HTTPS request to a public-looking domain that resolves to the machine sitting in front of you. Check the mapping:

Select-String -Path C:\Windows\System32\drivers\etc\hosts -Pattern sigwebtablet

HTTPS answers on 47290, HTTP on 47289. Quick liveness check:

Invoke-RestMethod -Uri "https://tablet.sigwebtablet.com:47290/SigWeb/TabletState"

If that returns a value, the pad, driver, service and certificate are all fine. Stop debugging them. The two things still broken are in the next two steps.

Step 4

Turn Off Signature Compression

Read the current value:

Invoke-RestMethod -Uri "https://tablet.sigwebtablet.com:47290/SigWeb/CompressionMode?noCache=$([guid]::NewGuid())"

If it's anything but 0, set it:

Invoke-RestMethod -Method Post -Uri "https://tablet.sigwebtablet.com:47290/SigWeb/CompressionMode/0"
Invoke-RestMethod -Uri "https://tablet.sigwebtablet.com:47290/SigWeb/CompressionMode?noCache=$([guid]::NewGuid())"

The second line should print 0. It survives service restarts and reboots, but re-check it after any SigWeb upgrade, since an upgrade is exactly what puts it back. While you're here, confirm encryption is off too:

Invoke-RestMethod -Uri "https://tablet.sigwebtablet.com:47290/SigWeb/EncryptionMode?noCache=$([guid]::NewGuid())"

Telling the Two Apart From the Browser

On a machine that works, the captured string is long and made of ASCII digits. On a broken one it's short and starts with binary bytes. In the Chrome console, on the Kipu form, after signing:

const v = document.querySelector('[name*="signature"]').value;
console.log(v.length, v.slice(0, 20));

About 5,000 characters starting with digits and line breaks is right. Around 1,400 characters of unprintable bytes means compression is still on.

Step 5

Let Chrome Reach the Local Service

Chrome treats a request from a public HTTPS site to a loopback address as Local Network Access and blocks it unless the site has permission. Kipu makes exactly that request: to SigWeb on 47290, and to a label printer service on 41951 if you run one.

When it's blocked, nothing errors in any useful way. The fetch hangs about two seconds, fails, and the signature dialog opens mouse-only. From inside the page it looks identical to a service that isn't running.

Set the policy machine-wide with a registry key Chrome reads at startup. No domain, Intune or group policy server involved. Swap the first URL for your own Kipu host:

$key = 'HKLM:\SOFTWARE\Policies\Google\Chrome\LocalNetworkAccessAllowedForUrls'
New-Item -Path $key -Force | Out-Null
$urls = @(
  'https://yourclinic.kipuworks.com',
  'https://tablet.sigwebtablet.com:47290',
  'https://localhost:41951'
)
for ($i = 0; $i -lt $urls.Count; $i++) {
  New-ItemProperty -Path $key -Name ($i + 1) -Value $urls[$i] -PropertyType String -Force | Out-Null
}
gpupdate /force

Chrome has to be fully quit and reopened, every window plus any background tray instance, before the policy takes. Check chrome://policy; the entry should show as applied with no conflict.

Step 6

Verify Before You Hand It Over

Open a Kipu form that needs a signature and look at the console. Kipu keeps its pad integration in a namespace you can poke at directly:

Object.keys(window.KipuSignaturePad || {});
window.KipuSignaturePad?.Topaz && 'Topaz driver loaded';

Then time the call to the service from inside the page. This is the cleanest test of Local Network Access, since it's the same path Kipu uses:

const t = performance.now();
fetch('https://tablet.sigwebtablet.com:47290/SigWeb/TabletState?x=' + Math.random())
  .then(r => console.log(r.status, Math.round(performance.now() - t) + 'ms'))
  .catch(e => console.log('BLOCKED', Math.round(performance.now() - t) + 'ms', e.message));

A healthy machine answers 200 in single or low double-digit milliseconds. A blocked one fails at roughly 2,000 ms every time. The timeout is the tell.

Then sign a real form end to end. Open a fresh one; signing a form you already signed during testing won't hit the save path again.

Troubleshooting

Symptoms and What They Actually Mean

Notes

A Few Other Things

The Kipu-side driver choice, SigWeb versus the older SigPlus or another vendor entirely, is set once by a Kipu admin for the whole instance. It isn't per workstation. If signing already works somewhere else in your organization, that setting is right. Leave it alone.

Write down the SigWeb version from a machine that works. When a replacement machine misbehaves, comparing versions and the two settings above gets you there faster than anything else I tried.

Rule out the USB port and cable early. Use the liveness check in step 3 for that; the pad's backlight tells you nothing useful.

Written up after one long afternoon so the next person has a shorter one. If it saved you the afternoon, buy me a coffee ☕

Not affiliated with Topaz Systems or Kipu Health. Product names belong to their owners.