Create Java KeyStore - Futurex Documentation

This section uses Java keytool to generate a new key pair and a self-signed Android APK signing certificate directly on the CryptoHub. On FXPKCS11 6.0 rev dc27 or later, this single command generates the key pair on the appliance and produces a usable PrivateKeyEntry with no CryptoHub UI step. You then list the keystore to confirm the private key and certificate are present. These steps ensure that you can use APKSigner and the self-signed certificate to sign an APK file in the next section.

The JDK installation includes the keytool application, so you can run the keytool commands in this section with no additional configuration.

Generate a key pair

Perform the following steps to generate a key pair and Android APK signing certificate on the CryptoHub:

Export FXPKCS11_CFG so the Futurex PKCS #11 library can locate its configuration file (fxpkcs11.cfg). Point it at the fxpkcs11.cfg you configured in Install and configure Futurex PKCS #11:

Shell

export FXPKCS11_CFG=/etc/fxpkcs11.cfg

On Windows, set FXPKCS11_CFG as a machine-wide variable with setx instead (see Configure SunPKCS11 to use the Futurex PKCS11 module). If you set fxpkcs11.cfg in its default location, this step is not required.

Execute the following command, passing the pkcs11.cfg file you created in the previous section with -providerArg. The -dname value sets the certificate subject (its Common Name), and the -ext flags add the code-signing extensions:

Text

keytool -genkeypair -alias apksignerdemo -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -dname "CN=apksignerdemo, O=Futurex" -validity 365 -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /usr/local/etc/pkcs11.cfg -providerName SunPKCS11-Futurex -ext extendedKeyUsage=codeSigning -ext KeyUsage=digitalSignature

The keytool application generates the key pair on the CryptoHub and self-signs a certificate for it. With no -storepass on the command line, keytool prompts for the KeyStore password.

When prompted for the KeyStore password, enter the CryptoHub identity password (PKCS #11 PIN) configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.

Verifying the Private Key and Certificate in the Java Keystore

Run the following keytool command on the device that will be signing APKs to confirm the key pair generated on the CryptoHub and lists a PrivateKeyEntry. The -providerArg flag passes the pkcs11.cfg file you created in the previous section:

Shell

keytool -list -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /usr/local/etc/pkcs11.cfg -providerName SunPKCS11-Futurex

When prompted for the keystore password, enter the identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.

If the command succeeds, you should see an output similar to the following:

None

Keystore type: PKCS11
Keystore provider: SunPKCS11-Futurex

Your keystore contains 1 entry

apksignerdemo-1784141140:apksignerdemo, PrivateKeyEntry,
Certificate fingerprint (SHA-256): 31:25:8E:83:D8:D9:DA:A3:03:33:E8:1B:27:29:B8:E4:B4:24:18:1E:17:7C:A0:CE:6A:3D:C0:E3:D1:97:71:0D

Important: Take note of the on-token alias (in this example, apksignerdemo-1784141140:apksignerdemo) of the entry, as that is needed for the signing command in the next section.

The CryptoHub assigns the on-token key its own alias in the form <alias>-<id>:<alias> (for example, apksignerdemo-1784141140:apksignerdemo), where <id> is generated per key and is not deterministic. This alias, not the short -alias value you passed to keytool -genkeypair, is what apksigner must reference. Copy the exact alias from this keytool -list output for the --ks-key-alias argument in the signing command in the next section.

​Generate a key pair

​Verifying the Private Key and Certificate in the Java Keystore

Generate a key pair

Verifying the Private Key and Certificate in the Java Keystore