Skip to main content
Verify your environment meets these requirements.

​
Supported hardware

  • CryptoHub, 7.0.3.x or later.

​
Supported operating systems

  • Linux
  • Windows

​
Required access

  • An account on the CryptoHub with administrator permissions to deploy new services.
  • Local administrator/root access on the computer where JSign is installed.

​
Network and firewall

  • Allow outbound TCP port 2001(default Host API port) from the computer running JSign to the CryptoHub, specified by FQDN (for example, cryptohub.example.com) or CIDR (for example, 10.0.0.0/24).
TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.

​
Supported software

  • Futurex PKCS #11 (FXPKCS11) 6.0 rev dc27 or later. The library bundled in the endpoint ZIP (4.59) does not support the keytool key-generation flow and lists 0 keystore entries. Obtain a 6.x build from the Futurex Portal and replace the bundled library.
  • JSign 7.4 or later. Download the signed release JAR from the JSign project site at https://ebourg.github.io/jsign/.
Use JSign 7.4 or later for Authenticode signing with a CryptoHub-resident key. JSign 7.1 signs the artifact successfully, but it does not embed the signer certificate in the signature, so Windows reports SignatureType: None and The certificate for the signer of the message is invalid or not found when it validates the file. JSign’s --certfile option does not work around this. JSign 7.4 embeds the certificate, and Windows then reads the signature as Authenticode.

​
Other

  • OpenSSL
  • Oracle Java or OpenJDK 11, 17, or 21
This integration works with either Oracle Java or OpenJDK. Use JDK version 11, 17, or 21.
The validated Linux platform for this guide is Ubuntu 24.04 LTS on x86_64 with OpenSSL 3.x and OpenJDK 21.

​
Verify the JSign installation

JSign ships as a single executable JAR. After you download it, confirm the JVM can run it:
Shell
The response prints the JSign usage banner, which begins with usage: java -jar jsign.jar [COMMAND] [OPTIONS] [FILE] and lists the supported commands and options. If the command fails, confirm java is on your PATH and that the JDK version is 11, 17, or 21. See Configure the JAVA_HOME environment variable.
JSign does not provide a --version option. Use --help to confirm the JAR runs, and read the version from the file name of the release you downloaded.
This guide uses jsign-7.4.jar in its examples. Adjust the file name to match the release you downloaded.