diff --git a/CMakeLists.txt b/CMakeLists.txt
index ca498cfeab..9425301ec9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -39,6 +39,7 @@ else()
         add_subdirectory( "${CORE_ROOT_DIR}/OfficeUtils/tests" officeutils_test )
         add_subdirectory( "${CORE_ROOT_DIR}/OdfFile/Reader/Converter/SMCustomShape2OOXML/TestSMCustomShape" starmath_smcustomshape_test )
         add_subdirectory( "${CORE_ROOT_DIR}/OdfFile/Test/test_odf" test_odf )
+        add_subdirectory( "${CORE_ROOT_DIR}/DesktopEditor/xmlsec/src/osign/test" osign_test )
     endif()
 
 endif()
diff --git a/DesktopEditor/xmlsec/src/osign/lib/CMakeLists.txt b/DesktopEditor/xmlsec/src/osign/lib/CMakeLists.txt
new file mode 100644
index 0000000000..fc2884c316
--- /dev/null
+++ b/DesktopEditor/xmlsec/src/osign/lib/CMakeLists.txt
@@ -0,0 +1,68 @@
+cmake_minimum_required(VERSION 3.10)
+
+project(osign VERSION 1)
+
+set(CORE_ROOT_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../../../..")
+
+include(${CORE_ROOT_DIR}/common.cmake)
+
+add_library(osign SHARED)
+
+if(NOT TARGET kernel)
+    add_subdirectory(${CORE_ROOT_DIR}/Common kernel)
+endif()
+
+# Set target version
+set_target_properties(osign PROPERTIES
+    VERSION ${PROJECT_VERSION}
+    SOVERSION 1
+)
+
+# HEADERS and SOURCES
+target_sources(osign PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}/include/osign.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/utils.h
+
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/buffer.cpp
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/storage.cpp
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/certificate.cpp
+
+    # osign.pro pulls this in through "CONFIG += open_ssl_common" (openssl.pri):
+    # certificate.cpp calls NSOpenSSL::PBKDF2, AES_*_desktop_GCM and CMemoryData.
+    ${CORE_ROOT_DIR}/Common/3dParty/openssl/common/common_openssl.h
+    ${CORE_ROOT_DIR}/Common/3dParty/openssl/common/common_openssl.cpp
+)
+
+target_include_directories(osign PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${CMAKE_CURRENT_SOURCE_DIR}/src
+    ${OPENSSL_INSTALL_DIR}/include
+)
+
+target_compile_definitions(osign PRIVATE
+    OSIGN_BUILDING
+    SUPPORT_OPENSSL
+    COMMON_OPENSSL_BUILDING
+)
+
+target_link_libraries(osign PRIVATE
+    ${OPENSSL_LIBSSL}
+    ${OPENSSL_LIBCRYPTO}
+    kernel
+)
+
+if(WIN32)
+    target_link_libraries(osign PRIVATE
+        Crypt32
+        Cryptui
+        Advapi32
+        Ws2_32
+        User32
+    )
+endif()
+
+set_default_options(osign)
+
+copy_artifacts_to_folder("osign" "${EO_CORE_OUTPUT_DIR}")
+
+declare_victory( osign )
diff --git a/DesktopEditor/xmlsec/src/osign/test/CMakeLists.txt b/DesktopEditor/xmlsec/src/osign/test/CMakeLists.txt
new file mode 100644
index 0000000000..105e80f3d7
--- /dev/null
+++ b/DesktopEditor/xmlsec/src/osign/test/CMakeLists.txt
@@ -0,0 +1,22 @@
+cmake_minimum_required(VERSION 3.10)
+
+project(osign_test)
+
+set(CORE_ROOT_DIR "${CMAKE_CURRENT_LIST_DIR}/../../../../..")
+
+include(${CORE_ROOT_DIR}/common.cmake)
+
+# Dependencies (mirror ADD_DEPENDENCY in test.pro).
+if(NOT TARGET kernel)
+    add_subdirectory(${CORE_ROOT_DIR}/Common kernel)
+endif()
+if(NOT TARGET osign)
+    add_subdirectory(${CORE_ROOT_DIR}/DesktopEditor/xmlsec/src/osign/lib osign)
+endif()
+
+add_core_gtest(
+    NAME    osign_test
+    SOURCES main.cpp
+    LIBS    kernel osign
+    GTEST_MAIN
+)
diff --git a/TESTING.md b/TESTING.md
index 4835b8aff1..0f675c31e0 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -98,6 +98,17 @@ Done:
       `ExampleFiles/motion.odp` is working-dir-relative). The committed `common.cpp` had
       absolute Windows include paths and a `#pragma comment(lib, ...)` block; these were
       replaced with repo-relative includes (CMake links the libraries).
+- [x] `DesktopEditor/xmlsec/src/osign/test` — deps: kernel and a new `osign` CMake library
+      target (`DesktopEditor/xmlsec/src/osign/lib/CMakeLists.txt`) ported from `osign.pro`.
+      No fixtures — the suite generates its own passwords and certificates at run time.
+      `common_openssl.cpp` is compiled into the library (`osign.pro` pulls it in through
+      `CONFIG += open_ssl_common`, and `certificate.cpp` needs `NSOpenSSL::PBKDF2` /
+      `AES_*_desktop_GCM`); `Base64.cpp` and `File.cpp` are **not** — the `.pro` compiled
+      them directly because qmake did not link kernel, but the CMake target links `kernel`,
+      which already provides `NSBase64`/`NSFile`. Unlike `ooxmlsignature` — which `x2tlib`
+      pulls into the default build — `osign` has no non-test consumer, so it is reached
+      only through the test's guarded `add_subdirectory` and nothing changes when
+      `EO_BUILD_TESTS` is OFF.
 
 ### gtest suites to migrate
 
@@ -114,8 +125,6 @@ Blocked / need extra work (build targets intentionally not created yet):
 - [ ] `DesktopEditor/doctrenderer/test/js_internal`
 - [ ] `DesktopEditor/doctrenderer/test/embed/internal/hash` — the three doctrenderer suites
       need a **V8 JS runtime** (and embedded scripts) at run time.
-- [ ] `DesktopEditor/xmlsec/src/osign/test` — **no `osign` CMake target exists**; the
-      library must be ported to CMake first.
 
 ### Deferred: non-gtest qmake `.pro` tools