Skip to main content
JSign is an open-source, cross-platform code-signing tool that applies Authenticode signatures to Windows executables, installers, and scripts from any operating system that runs a JVM. It signs Windows PE files (EXE and DLL), MSI installers, APPX and MSIX packages, Windows script files, and PowerShell scripts. Because JSign runs on the Java platform, it reaches CryptoHub-resident signing keys through the Java SunPKCS11 provider and the Futurex PKCS #11 (FXPKCS11) module. The private key never leaves the CryptoHub: JSign hashes the artifact locally, sends the digest to the appliance for signing, and embeds the returned signature in the file.

​
Key features

This integration has the following features:
  • Authenticode signing without Windows: Sign Windows artifacts from Linux, macOS, or Windows build hosts, so a CI pipeline does not need a Windows signing agent.
  • Broad artifact support: Sign PE executables and libraries, MSI installers, APPX and MSIX packages, CAB archives, Windows script files, and PowerShell scripts with one tool.
  • Hardware-backed keys through PKCS #11: Access HSM-protected keys through the standard PKCS #11 interface, with no export of private key material.
  • Selectable digest algorithms: Choose the signature digest, including SHA-256 and SHA-384, to match your organization’s signing policy.
  • Timestamp support: Add an RFC 3161 timestamp so signatures remain valid after the signing certificate expires.
  • Command-line automation: Run JSign as a standalone JAR, so signing drops into existing Maven, Gradle, and shell-driven release pipelines.
  • Signature verification: Inspect and validate the signatures JSign applies to confirm artifact authenticity and integrity.

​
Benefits of CryptoHub integration through PKCS #11

Integrating with CryptoHub provides the following benefits:
  • Enhanced security: The code-signing private key is generated on the CryptoHub as a non-extractable token object, so it cannot be copied off the appliance or exposed on a build host.
  • Efficient cryptographic operations: Futurex HSMs handle cryptographic operations efficiently, so signing adds minimal latency to a release pipeline.
  • Compliance readiness: Storing code-signing keys in a CryptoHub helps you meet requirements, such as FIPS 140-2 and the CA/Browser Forum code-signing baseline requirements, that mandate hardware protection for signing keys.
  • Operational resilience: CryptoHub high-availability and failover features keep signing operations available during a system failure.
  • Streamlined key management: CryptoHub provides a centralized repository for signing keys, which simplifies management, rotation, and access review.
  • Standards-based integration: The SunPKCS11 provider connects JSign to CryptoHub with no custom development and no vendor-specific plugin.