> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Java Jarsigner

> Configuration guidance for integrating Futurex HSMs with Java Jarsigner via PKCS#11.

This document provides information about configuring Futurex HSMs with Java Jarsigner by using PKCS #11 libraries. For additional questions related to your HSM, see the relevant administrator guide.

## Application description

From the Oracle documentation website:

The Java `jarsigner` tool serves the following purposes:

1. To sign Java ARchive (JAR) files
2. To verify the signatures and integrity of the signed JAR files.

The JAR feature enables the packaging of class files, images, sounds, and other digital data in a single file for faster and easier distribution. A tool named `jar` enables developers to produce JAR files. (Technically, any zip file can also be considered a JAR file, although when created by the jar command or processed by the `jarsigner` command, JAR files also contain a `META-INF/MANIFEST.MF` file.)

A digital signature is a string of bits that is computed from some data (the data being signed) and the private key of an entity (a person, company, and so on). Similar to a handwritten signature, a digital signature has many useful characteristics:

* Its authenticity can be verified by a computation that uses the public key corresponding to the private key used to generate the signature.
* It cannot be forged, assuming the private key is kept secret.
* It is a function of the date assigned and thus cannot be claimed to be the signature for other data as well.
* The signed data cannot be changed. If the data is changed, then the signature cannot be verified as authentic.

To generate an entity's signature for a file, the entity must first have a public/private key pair associated with it and one or more certificates that authenticate its public key. A certificate is a digitally signed statement from one entity that says that the public key of another entity has a particular value.

The `jarsigner` command uses key and certificate information from a keystore to generate digital signatures for JAR files. A keystore is a database of private keys and their associated X.509 certificate chains that authenticate the corresponding public keys. The `keytool` command is used to create and administer keystores.

The `jarsigner` command uses an entity's private key to generate a signature. The signed JAR file contains, among other things, a copy of the certificate from the keystore for the public key corresponding to the private key used to sign the file. The `jarsigner` command can verify the digital signature of the signed JAR file using the certificate inside it (in its signature block file).

The `jarsigner` command can generate signatures that include a time stamp that lets a system or deployer (including Java Plug-in) check whether the JAR file was signed while the signing certificate was still valid. In addition, APIs allow applications to obtain the timestamp information.

At this time, the `jarsigner` command can only sign JAR files created by the `jar` command or zip files. JAR files are the same as zip files, except they also have a `META-INF/MANIFEST.MF` file. A `META-INF/MANIFEST.MF` file is created when the jarsigner command signs a zip file.

A default `jarsigner` command behavior is to sign a JAR or zip file. Use the `-verify` option to verify a signed JAR file.

The `jarsigner` command also attempts to validate the signer's certificate after signing or verifying. If there is a validation error or any other problem, the command generates warning messages. If you specify the `-strict` option, then the command treats severe warnings as errors. See [**Errors and Warnings**](https://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html#CCHBFBIC).

## Guardian integration

The Guardian Series 3 introduces mission-critical viability to core cryptographic infrastructure, including:

* Centralization of device management
* Elimination of points of failure
* Distribution of transaction loads
* Group-specific function blocking
* User-defined grouping systems

See the applicable guide in the Futurex Portal for configuring HSMs with the Guardian Series 3, including PKCS #11 and CNG configuration.