Jarsigner command examples - Futurex Documentation

The Java jarsigner tool serves the following purposes:

Signs Java ARchive (JAR) files.
Verifies the signatures and integrity of signed JAR files.

The following sections provide examples of both purposes.

Sign a JAR file

Before signing a JAR file, ensure that the keys stored on the CryptoHub needed for signing are accessible.

First, go to the $JAVA_HOME/bin directory:

Shell

cd $JAVA_HOME/bin

Then, run the following keytool command to list all of the keys on the CryptoHub that the configured identity has access to. The -providerArg flag passes the pkcs11.cfg file you created earlier:

Shell

keytool -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /usr/local/etc/pkcs11.cfg -providerName SunPKCS11-Futurex -list

When prompted for the KeyStore password in this command and the following commands, enter the CryptoHub identity password configured inside the <CRYPTO-OPR-PASS> tag in the fxpkcs11.cfg file.

The response should be similar to the following:

Shell

Keystore type: PKCS11
Keystore provider: SunPKCS11-Futurex

Your keystore contains 1 entry

jarsigner-demo-1784141140:jarsigner-demo, PrivateKeyEntry,
Certificate fingerprint (SHA-256): 0E:79:5C:23:06:13:91:42:C8:3A:F7:52:4F:3A:F0:0A:66:28:79:E1:BB:A5:AA:F0:69:B0:AB:EA:F8:54:00:16

Now that you know the keys needed for code signing are accessible, run the following command to sign a JAR file using the CryptoHub-stored keys. The -providerArg flag passes the pkcs11.cfg file:

You must run the command from the same directory where you stored the example.jar file.

Shell

jarsigner -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg /usr/local/etc/pkcs11.cfg -providerName SunPKCS11-Futurex -signedjar demo_signed.jar example.jar "jarsigner-demo-1784141140:jarsigner-demo"

You must copy and paste the alias in the last field of the preceding jarsigner command (for example, jarsigner-demo-1784141140:jarsigner-demo) from the output of the keytool -list command in step 2. The CryptoHub assigns the on-token key an alias in the form <alias>-<id>:<alias>, which differs from the short -alias value you passed to keytool -genkeypair.

If the signing succeeds, the response includes a confirmation message that says, jar signed.

Refer to the Oracle documentation to learn about flags that you can use in the preceding jarsigner command, such as -tsa and -tsacert.

Verify the signature

Run the following command to verify the signature of the signed JAR file output from the previous jarsigner command, demo_signed.jar:

Shell

jarsigner -verify demo_signed.jar -verbose -certs

If the verification succeeds, the response includes a confirmation message that says, jar verified.

Verification is a separate JVM invocation that carries no provider flags and no credential path. It reads the signature and digests out of the JAR itself and never contacts the CryptoHub, so it does not need the SunPKCS11 provider or the Futurex PKCS #11 library.

On a Linux host running in FIPS mode, this command fails with java.security.NoSuchAlgorithmException: SHA-384 MessageDigest not available and reports the JAR as unsigned, even though signing succeeded. The FIPS-mode JDK restricts JAR verification to a hardcoded set of providers that supply no digest implementations. This is a platform limitation with no Futurex-side fix. Verify with -J-Dcom.redhat.fips=false, or verify outside FIPS mode. See Troubleshooting for the full explanation.

​Sign a JAR file

​Verify the signature

Sign a JAR file

Verify the signature