> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Before you start

> Checklist of environment prerequisites and requirements before integrating JSign with CryptoHub.

Verify your environment meets these requirements.

## Supported hardware

* CryptoHub, `7.0.3.x` or later.

## Supported operating systems

* Linux
* Windows

## Required access

* An account on the CryptoHub with administrator permissions to deploy new services.
* Local administrator/root access on the computer where JSign is installed.

## Network and firewall

* Allow outbound TCP port **2001**(default Host API port) from the computer running JSign to the CryptoHub, specified by FQDN (for example, `cryptohub.example.com`) or CIDR (for example, `10.0.0.0/24`).

<Warning>
  TLS inspection or SSL proxies can break mutual TLS handshakes. Exempt the CryptoHub FQDN(s) from inspection. Configure the CryptoHub with a FQDN so the exemption applies.
</Warning>

## Supported software

* **Futurex PKCS #11 (FXPKCS11) 6.0 rev dc27 or later.** The library bundled in the endpoint ZIP (4.59) does not support the keytool key-generation flow and lists 0 keystore entries. Obtain a 6.x build from the Futurex Portal and replace the bundled library.
* **JSign 7.4 or later.** Download the signed release JAR from the JSign project site at [https://ebourg.github.io/jsign/](https://ebourg.github.io/jsign/).

<Warning>
  Use JSign **7.4 or later** for Authenticode signing with a CryptoHub-resident key. JSign 7.1 signs the artifact successfully, but it does not embed the signer certificate in the signature, so Windows reports `SignatureType: None` and `The certificate for the signer of the message is invalid or not found` when it validates the file. JSign's `--certfile` option does not work around this. JSign 7.4 embeds the certificate, and Windows then reads the signature as Authenticode.
</Warning>

## Other

* OpenSSL
* Oracle Java or OpenJDK 11, 17, or 21

<Note>
  This integration works with either Oracle Java or OpenJDK. Use JDK version 11, 17, or 21.
</Note>

The validated Linux platform for this guide is Ubuntu 24.04 LTS on x86\_64 with OpenSSL 3.x and OpenJDK 21.

## Verify the JSign installation

JSign ships as a single executable JAR. After you download it, confirm the JVM can run it:

```shell expandable lines wrap title="Shell" theme={null}
java -jar jsign-7.4.jar --help
```

<Check>
  The response prints the JSign usage banner, which begins with `usage: java -jar jsign.jar [COMMAND] [OPTIONS] [FILE]` and lists the supported commands and options. If the command fails, confirm `java` is on your **PATH** and that the JDK version is 11, 17, or 21. See [Configure the JAVA\_HOME environment variable](/Integrations/CryptoHub/Code_signing/JSign/Configure_the_JAVA_HOME_environment_variable).
</Check>

<Note>
  JSign does not provide a `--version` option. Use `--help` to confirm the JAR runs, and read the version from the file name of the release you downloaded.
</Note>

<Note>
  This guide uses `jsign-7.4.jar` in its examples. Adjust the file name to match the release you downloaded.
</Note>