Skip to main content
Perform the following tasks to configure the KMES Series 3 to provide all functionality that Java Jarsigner needs for code signing and verification of JAR files:
  1. Enable Host API commands.
  2. Create a Jarsigner role with the required permissions.
  3. Create a Jarsigner identity with the correct assigned roles.
  4. Create a signing approval group and give it appropriate permissions.
  5. Create a Jarsigner code signing certificate.
  6. Apply an issuance policy to the Jarsigner code signing certificate.
The following sections show you how to complete these tasks.

​
Enable the commands

Perform the following steps to enable the required Host API commands:
1
Go to Administration > Configuration > Host API Options.
2
Enable the following commands:
CommandDescription
ECHOCommunication Test/Retrieve Version
RAFAEnumerate issuance policies
RAGARetrieve issuance policy details
RAGORetrieve Request (Hash Signing)
RAUOUpload Request (Hash Signing)
RKCPGet Command Permissions
RKLNLookup Objects
RKLOLogin User
RKRKRetrieve Generated Keys
TIMESet Time
3
Select [ Save ] to finish.

​
Create a Jarsigner role

Perform the following steps to create a Jarsigner role with the required permissions:
1
Go to Identity Management > Roles, and select [ Add ] at the bottom of the page.
2
Select Application as the role Type, specify a name for the role, and set the Logins Required to 1.
3
On the Permissions tab, ensure that you select only the following permissions:
PermissionAdditional sub permissions (if applicable)
Certificate AuthorityExport, Upload
KeysTop-level permission only
4
On the Advanced tab, select only Host API for Allowed Ports.
5
Select [ OK ] to save and create the role.

​
Create a Jarsigner identity

Perform the following steps to create a Jarsigner identity with the correct assigned roles:
1
Go to Identity Management > Identities, right-click the background, and select Add > Client Application.
2
On the Info tab, select Application for the storage type and specify a name for the identity.
3
On the Assigned Roles tab, select the role you created in the previous section.
4
On the Authentication tab, remove the API Key mechanism, add the password mechanism, and set a password.
5
Select [ OK ] to save and create the identity.

​
Create a signing approval group

Perform the following steps to create a signing approval group and give it appropriate permissions:
1
Go to PKI > Signing Workflow and select [ Add Approval Group ] at the bottom of the page.
2
Set a name for the Approval Group, such as Jarsigner, and select [ OK ] to save.
3
Right-click the Jarsigner Approval Group and select [ Permission ].
4
Select the Show all roles and permissions checkbox, and grant the Jarsigner role the Use permission. Select [ OK ] to save and finish.

​
Create a code signing certificate

This section describes using a CA on the KMES to issue a Jarsigner code signing certificate:
1
Go to PKI > Certificate Authorities, and select [ Add CA ] at the bottom of the page.
2
In the Certificate Authority window, enter a name for the Certificate Container, such as Jarsigner. Set the owner of the field to the Jarsigner role and select [ OK ].
The new certificate container now displays in the Certificate Authorities menu.
3
Right-click the Jarsigner certificate container and select Add Certificate > New Certificate.
4
On the Subject DN tab, set a Common Name for the certificate, such as Code Signing.
5
Go to the V3 Extensions tab, select the Code Signing Certificate profile, and select [ OK ].
The code signing certificate now displays under the Root CA certificate inside of the Jarsigner certificate container.

​
Apply an issuance policy

Perform the following steps to apply an issuance policy to the Jarsigner code signing certificate:
1
Go to PKI > Certificate Authorities.
2
Right-click the Code Signing certificate and select Issuance Policy > Add.
3
On the Basic Info tab, set Approvals to 0 to allow anonymous singing. Select SHA-384 as an allowed hash. You do not need to specify an Alias.
4
On the X.509 tab, set the Default approval group to Jarsigner.
5
On the Object Signing tab, select the Allow object signing checkbox.
6
Select [ OK ] to apply the issuance policy to the Jarsigner code signing certificate.