Skip to main content
This section provides examples of how you use the jarsigner command to sign a Java ARchive (JAR) file and verify the signature of a signed JAR file.

​
Sign a Java ARchive file

Before performing the following steps to sign a JAR file (example.jar, in this case), ensure that the keys stored on the KMES Series 3 that you need for signing are accessible:
1
Run the following command to go to the $JAVA_HOME/bin directory:
Shell
2
Run the following keytool command to list all of the keys on the KMES that the configured identity can access:
Shell
The response should be similar to the following:
Shell
3
Change to the directory that contains the example.jar file.
4
After you confirm the keys needed for code signing are accessible and change to the directory with the example.jar file, run the following command to sign a JAR file by using the KMES-stored keys:
Shell
You must copy and paste the value specified in the last field of the preceding jarsigner command, Jarsigner:Code Signing:C, from the output you see in the list command in step 2 (for example on line 6, Jarsigner:Code Signing:C).Refer to the Oracle documentation to learn about other jarsigner command flags, such as -tsa and -tsacert.
If the signing succeeds, the response includes a confirmation message that says: jar signed.

​
Verify the signature

Perform the following step to verify the signature of a signed JAR file:
1
The jarsigner command in the previous section returned a signed JAR file, demo_ signed.jar. Now, run the following command to verify the signature of that file:
Shell
If the verification succeeds, the response includes a confirmation message: jar verified.
Verification is a separate JVM invocation that carries no provider flags and no credential path. It reads the signature and digests out of the JAR itself and never contacts the KMES Series 3, so it does not need the SunPKCS11 provider or the Futurex PKCS #11 library.
On a Linux host running in FIPS mode, this command fails with java.security.NoSuchAlgorithmException: SHA-384 MessageDigest not available and reports the JAR as unsigned, even though signing succeeded. The FIPS-mode JDK restricts JAR verification to a hardcoded set of providers that supply no digest implementations. This is a platform limitation with no Futurex-side fix. Verify with -J-Dcom.redhat.fips=false, or verify outside FIPS mode. See Troubleshooting for the full explanation.