> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# JSign

> Conceptual overview of JSign and its integration benefits with CryptoHub via PKCS #11.

JSign is an open-source, cross-platform code-signing tool that applies Authenticode signatures to Windows executables, installers, and scripts from any operating system that runs a JVM. It signs Windows PE files (EXE and DLL), MSI installers, APPX and MSIX packages, Windows script files, and PowerShell scripts.

Because JSign runs on the Java platform, it reaches CryptoHub-resident signing keys through the Java SunPKCS11 provider and the Futurex PKCS #11 (FXPKCS11) module. The private key never leaves the CryptoHub: JSign hashes the artifact locally, sends the digest to the appliance for signing, and embeds the returned signature in the file.

## Key features

This integration has the following features:

* **Authenticode signing without Windows**: Sign Windows artifacts from Linux, macOS, or Windows build hosts, so a CI pipeline does not need a Windows signing agent.
* **Broad artifact support**: Sign PE executables and libraries, MSI installers, APPX and MSIX packages, CAB archives, Windows script files, and PowerShell scripts with one tool.
* **Hardware-backed keys through PKCS #11**: Access HSM-protected keys through the standard PKCS #11 interface, with no export of private key material.
* **Selectable digest algorithms**: Choose the signature digest, including SHA-256 and SHA-384, to match your organization's signing policy.
* **Timestamp support**: Add an RFC 3161 timestamp so signatures remain valid after the signing certificate expires.
* **Command-line automation**: Run JSign as a standalone JAR, so signing drops into existing Maven, Gradle, and shell-driven release pipelines.
* **Signature verification**: Inspect and validate the signatures JSign applies to confirm artifact authenticity and integrity.

## Benefits of CryptoHub integration through PKCS #11

Integrating with CryptoHub provides the following benefits:

* **Enhanced security**: The code-signing private key is generated on the CryptoHub as a non-extractable token object, so it cannot be copied off the appliance or exposed on a build host.
* **Efficient cryptographic operations**: Futurex HSMs handle cryptographic operations efficiently, so signing adds minimal latency to a release pipeline.
* **Compliance readiness**: Storing code-signing keys in a CryptoHub helps you meet requirements, such as FIPS 140-2 and the CA/Browser Forum code-signing baseline requirements, that mandate hardware protection for signing keys.
* **Operational resilience**: CryptoHub high-availability and failover features keep signing operations available during a system failure.
* **Streamlined key management**: CryptoHub provides a centralized repository for signing keys, which simplifies management, rotation, and access review.
* **Standards-based integration**: The SunPKCS11 provider connects JSign to CryptoHub with no custom development and no vendor-specific plugin.


## Related topics

- [JSign command examples](/Integrations/CryptoHub/Code_signing/JSign/JSign_command_examples.md)
- [Before you start](/Integrations/CryptoHub/Code_signing/JSign/Before_you_start.md)
- [Generate a code signing key pair](/Integrations/CryptoHub/Code_signing/JSign/Generate_a_code_signing_key_pair.md)
- [Deploy the service](/Integrations/CryptoHub/Code_signing/JSign/Deploy_the_service.md)
- [Configure SunPKCS11 to use the Futurex PKCS11 module](/Integrations/CryptoHub/Code_signing/JSign/Configure_SunPKCS11_to_use_the_Futurex_PKCS11_module.md)