Skip to main content
The Java jarsigner tool serves the following purposes:
  • Signs Java ARchive (JAR) files.
  • Verifies the signatures and integrity of signed JAR files.
The following sections provide examples of each function:

​
Sign a Java Archive file

Perform the following steps to ensure that the keys stored on the HSM (that you need for signing) are accessible and sign a JAR file:
1
Go to the $JAVA_HOME/bin directory:
Shell
2
Run the following keytool command to list all of the keys on the HSM that the configured identity can access:
Shell
The response should be similar to the following example:
Shell
3
Now that you’ve confirmed the keys needed for code signing are accessible, run the following command to sign a JAR file by using the HSM-stored keys:
The last field in thefollowing command, JarsignerDemo, must match the alias you specified in the keytool -importcert command in the previous section.
Shell
4
When prompted for the passphrase of the KeyStore, enter the password you specified for the JarsignerDemo KeyStore in the previous section.
If the signing succeeds, the response includes a confirmation message that says: jar signed.
Refer to the Oracle documentation about other flags you can use in the preceding jarsigner command, such as -tsa and -tsacert.

​
Verify the signature of a signed JAR file

The jarsigner command in the previous section returned a signed JAR file called demo_signed.jar. To verify the signature, perform the following task:
1
Run the following command to verify the signature of that file:
Shell
If the verification succeeds, the response includes a confirmation message saying jar verified.
Verification is a separate JVM invocation that carries no provider flags and no credential path. It reads the signature and digests out of the JAR itself and never contacts the HSM, so it does not need the SunPKCS11 provider or the Futurex PKCS #11 library.
On a Linux host running in FIPS mode, this command fails with java.security.NoSuchAlgorithmException: SHA-384 MessageDigest not available and reports the JAR as unsigned, even though signing succeeded. The FIPS-mode JDK restricts JAR verification to a hardcoded set of providers that supply no digest implementations. This is a platform limitation with no Futurex-side fix. Verify with -J-Dcom.redhat.fips=false, or verify outside FIPS mode. See Troubleshooting for the full explanation.