> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Java Jarsigner

> Configure KMES Series 3 for Java Jarsigner using PKCS #11 libraries.

This document covers configuring the KMES Series 3 with Java Jarsigner by using PKCS #11 libraries. For additional questions about your KMES Series 3 device, see the [KMES Series 3 user guide](https://docs.futurex.com/Legacy_Products/bam/6.3.6.x/product-specific/kmes-series-3/admin-guide).

## About Java Jarsigner

From the Oracle documentation website:

Java `jarsigner` tool serves two purposes:

* To sign Java ARchive (JAR) files.
* To verify the signatures and integrity of signed JAR files.

The JAR feature enables you to package class files, images, sounds, and other digital data in a single file for faster and easier distribution. The **jar** tool enables developers to produce JAR files. Technically, you can consider any zip file a JAR file, although when you create an archive with the **jar** command or process it with the `jarsigner` command, JAR files also contain a **META-INF/MANIFEST.MF** file.

A digital signature is a string of bits that is computed from some data (the data being signed) and the private key of an entity (a person, company, and so on). Similar to a handwritten signature, a digital signature has the following characteristics:

* Its authenticity can be verified by a computation that uses the public key corresponding to the private key used to generate the signature.
* It cannot be forged, provided the private key remains secret.
* It is a function of the data signed and thus cannot be claimed to be the signature for other data as well.
* The signed data cannot be changed. If the data is changed, then the signature cannot be verified as authentic.

To generate an entity's signature for a file, the entity must first have a public/private key pair associated with it and one or more certificates that authenticate its public key. A certificate is a digitally signed statement from one entity that confirms the public key of another entity has a specific value.

`jarsigner` creates signatures by using the following methods:

* Uses key and certificate information from a keystore to generate digital signatures for JAR files. A keystore is a database of private keys and their corresponding X.509 certificate chains, which authenticate the associated public keys. You can use the `keytool` command to create and administer keystores.
* Uses an entity's private key to generate a signature. The signed JAR file contains, among other things, a copy of the certificate from the keystore for the public key corresponding to the private key used to sign the file. The `jarsigner` command can then verify the digital signature of the signed JAR file by using the certificate inside it (in its signature block file).
* Generates signatures that include a time stamp that enables a system or deployer (including Java Plug-in) to check whether the JAR file was signed while the signing certificate was still valid. Additionally, APIs enable applications to retrieve timestamp information.

At this time, `jarsigner` can only sign zip files or JAR files created by the `jar` command. JAR files are the same as zip files, except they also have a `META-INF/MANIFEST.MF` file, created when the `jarsigner` command signs a zip file.

By default, `jarsigner` signs a JAR or zip file. Use the **-verify** option to verify a signed JAR file.

`jarsigner` also attempts to validate the signer's certificate after signing or verifying. If a validation error or any other problem occurs, the command generates warning messages. If you specify the **-strict** option, then the command treats severe warnings as errors. See the **Errors and Warnings** document ([**docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html#CCHBFBIC**](https://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html#CCHBFBIC)).

## Integration overview

This guide shows you how to perform the following tasks:

1. Install Futurex **PKCS #11**.
2. Set system environment variables for the Java and Futurex **PKCS #11** libraries.
3. Install the FXJCE files.
4. Configure the KMES Series 3.
5. Edit the Futurex PKCS #11 configuration file.
6. Create Java keystore.
7. Use the **jarsigner** command.

The following sections show you how to perform these tasks.


## Related topics

- [Java Jarsigner](/Integrations/HSM/Code_signing/Java_Jarsigner/Java_Jarsigner.md)
- [Create an application partition for Java Jarsigner](/Integrations/HSM/Code_signing/Java_Jarsigner/Configure_the_Vectera_Plus/Create_an_application_partition_for_Java_Jarsigner.md)
- [Jarsigner command examples](/Integrations/HSM/Code_signing/Java_Jarsigner/Jarsigner_command_examples.md)
- [Create Java KeyStore](/Integrations/CryptoHub/Code_signing/Java_Jarsigner/Create_Java_KeyStore.md)
- [Configure KMES for code signing and verification of JAR files](/Integrations/KMES_Series_3/Code_signing/Java_Jarsigner/Configure_KMES_for_code_signing_and_verification_of_JAR_files.md)