For APK signing, we use APKSigner which is command-line utility included in the Android SDK Build Tools that allows you to sign Android application package (APK) files and verify their signatures. It's an essential tool for Android developers to ensure the integrity and authenticity of their apps.
To sign your APK using APKSigner and our PKCS#11 wrapper in Ubuntu, please follow the below steps:
Go to EC CodeSign Secure’s v3.02’s Signing Tools section and download the PKCS11 Wrapper for Ubuntu.
After that, generate a P12 Authentication certificate from the System Setup > User > Generate Authentication Certificate dropdown.
Go to your Ubuntu client system and edit the configuration files (ec_pkcs11client.ini and pkcs11properties.cfg) downloaded in the PKCS11 Wrapper.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
Now we need to add the environment variable for the pkcs11 client library.
Run the below command to open the bashrc file:
nano ~/.bashrc
Now add the EC_INI_FILE_PATH variable with the path of the .ini at the end of the bashrc file, like:
export EC_INI_FILE_PATH=/home/administrator/PKCS11_Wrapper-Ubuntu/ec_pkcs11client.ini
Press Ctrl+X, then enter Y, and then press Enter to save.
Reload the environment variables
source ~/.bashrc
Check whether the variable has been set correctly
echo $EC_INI_FILE_PATH
NOTE: If you can't see the file location from echo commands, open a new terminal and try again.
Now, let’s install some prerequisites in your client system to run the PKCS11 Wrapper.
Install Java 8: sudo apt install openjdk-8-jdk
Set Java 8 as the active version: sudo update-alternatives --config java
Install the Android SDK command-line tools: sudo apt install google-android-cmdline-tools-13.0-installer
Ensure that the SDK Manager for Android Studio has been properly installed: sdkmanager --version
Install Build tools using SDKManager, which contains the APKSigner: sdkmanager "build-tools;34.0.0"
Ensure that APKSigner is present: apksigner --version
Two packages are required to run the PKCS11 Wrapper on your system. First, install liblog4cxx-dev using: sudo apt-get install liblog4cxx-dev
The last prerequisite is to install the curl package: sudo apt-get install curl
Now that all the configurations and prerequisites have been installed. Let’s perform the signing operation first.
The signing command will look something like this (ensure you run this command only inside the folder where your PKCS11 Wrapper is installed):
apksigner sign --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg <path of the pkcs11properties.cfg file in your system> --ks NONE --ks-type PKCS11 --ks-pass pass:abcd1234 --ks-key-alias <private key alias> --in <path of the APK file you want to sign> --out <path of the Signed APK file>
A sample command is provided below:
apksigner sign --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg /home/administrator/PKCS11_Wrapper-Ubuntu/pkcs11properties.cfg --ks NONE --ks-type PKCS11 --ks-pass env:KS_PASS --ks-key-alias EC-Cert-020 --in Sample.apk --out signed.apk
Important: apksigner needs a keystore password argument. Put it in an environment variable, for example export KS_PASS='<password>' on Linux and macOS or set KS_PASS=<password> on Windows, instead of typing it on the command line, where it is saved in shell history and CI logs. Replace EC-Cert-020 with the key label of your signing certificate.
NOTE: When working with Luna HSM, use the following signing command structure:
apksigner sign --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg <path of the pkcs11properties.cfg file in your system> --ks NONE --ks-type PKCS11 --ks-pass pass:abcd1234 --ks-key-alias <private key alias> --in <path of the APK file you want to sign> --out <path of the Signed APK file> --min-sdk-version 28
After successfully signing the APK, let’s verify it using this command:
apksigner verify -verbose <path of the signed APK file>A sample command is provided below:
apksigner verify -verbose signed.apk
NOTE: When working with Luna HSM, use the following verifying command structure:
apksigner verify -verbose --min-sdk-version 28 <path of the signed APK file>To perform APK Signing using APKSigner Tool and our PKCS11 Wrapper in MacOS machine, you would need to follow the below steps:
Go to EC CodeSign Secure’s v3.02’s Signing Tools section and download the PKCS11 Wrapper for MacOS.
After that, generate a P12 Authentication certificate from the System Setup > User > Generate Authentication Certificate dropdown.
Go to your MacOS client system and edit the configuration files (ec_pkcs11client.ini and pkcs11properties.cfg) downloaded in the PKCS11 Wrapper.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
Now, let’s install some prerequisites in your client system to run the PKCS11 Wrapper.
Install Java 17: brew install openjdk@17
Set Java 17 as the active version
For Zsh: nano ~/.zshrc
For Bash: nano ~/.bash_profile
Add these lines:
export JAVA_HOME=$(/usr/libexec/java_home -v 17)
export PATH=$JAVA_HOME/bin:$PATH
And then run:
source ~/.zshrc
or
source ~/.bash_profile
Install the Android SDK command-line tools from this site
Ensure that the SDK Manager for Android Studio has been properly installed: sdkmanager --sdk_root=/Users/subhayuroy/PKCS11_Wrapper-Mac --version
Install Build tools using SDKManager, which contains the APKSigner: sdkmanager --sdk_root=/Users/subhayuroy/PKCS11_Wrapper-Mac "build-tools;34.0.0"
Ensure that APKSigner is present: ls /Users/subhayuroy/PKCS11_Wrapper-Mac/build-tools/34.0.0/apksigner
Two packages are required to run the PKCS11 Wrapper on your system. First, install liblog4cxx-dev using: brew install log4cxx
The last prerequisite is to install the curl package: brew install curl
You need to ensure all the relative paths are added to
your PATH variable (~/.zshrc file):
export
PATH=/Users/subhayuroy/PKCS11_Wrapper-Mac/cmdline-tools/bin:$PATH
export JAVA_HOME=$(/usr/libexec/java_home -v 17)
export PATH=$JAVA_HOME/bin:$PATH
export
ANDROID_SDK_ROOT=/Users/subhayuroy/PKCS11_Wrapper-Mac
export
PATH=$PATH:/Users/subhayuroy/PKCS11_Wrapper-Mac/build-tools/34.0.0
Now that all the configurations and prerequisites have been installed. Let’s perform the signing operation first.
The signing command will look something like this (ensure you run this command only inside the folder where your PKCS11 Wrapper is installed):
java --add-exports=jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED -jar <path of the apksigner.jar in your system> sign --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg <path of the pkcs11properties.cfg file in your system> --ks NONE --ks-type PKCS11 --ks-pass env:KS_PASS --ks-key-alias <private key alias> --in <path of the APK file you want to sign> --out <path of the Signed APK file>
A sample command is provided below:
java --add-exports=jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED -jar /Users/subhayuroy/PKCS11_Wrapper-Mac/build-tools/34.0.0/lib/apksigner.jar sign --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg /Users/subhayuroy/PKCS11_Wrapper-Mac/pkcs11properties.cfg --ks NONE --ks-type PKCS11 --ks-pass env:KS_PASS --ks-key-alias EC-Cert-020 --in Sample.apk --out signed.apk
After successfully signing the APK, let’s verify it using this command:
apksigner verify -verbose <path of the signed APK file>
A sample command is provided below:
apksigner verify -verbose signed.apk
To perform APK Signing using APKSigner Tool and our PKCS11 Wrapper in Windows machine, you would need to follow the below steps:
Go to EC CodeSign Secure’s v3.02’s Signing Tools section and download the PKCS11 Wrapper for Windows.
After that, generate a P12 Authentication certificate from the System Setup > User > Generate Authentication Certificate dropdown.
Go to your Windows client system and edit the configuration files (ec_pkcs11client.ini and pkcs11properties.cfg) downloaded in the PKCS11 Wrapper.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
Now, let’s install some prerequisites in your client system to run the PKCS11 Wrapper.
Install Java 22 from Oracle’s official site, and follow the instructions in the msi file.
Set Java 22 as the active version by storing the bin path in the PATH variable.
Install the Android SDK command-line tools from this link here.
Extract the files into a “cmdline-tools” folder and create a subfolder named latest. Now, move the bin and lib folders into the latest folder.
Set an environment variable called ANDROID_HOME and set it to the path where you extracted the command line tools.
Install Build tools using SDKManager, which contains the APKSigner: .\bin\sdkmanager --channel=0 --install "build-tools;34.0.0"
Ensure that APKSigner is present: Apksigner.bat --version
Open the Apksigner.bat file and update the last line to the below command:
call "%java_exe%" --add-exports jdk.crypto.cryptoki/sun.security.pkcs11=ALL-UNNAMED %javaOpts% -jar "%jarpath%" %params%
Now that all the configurations and prerequisites have been installed. Let’s perform the signing operation first.
The signing command will look something like this (ensure you run this command only inside the folder where your PKCS11 Wrapper installed):
apksigner sign --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg <path of the pkcs11properties.cfg file in your system> --ks NONE --ks-type PKCS11 --ks-pass env:KS_PASS --ks-key-alias <private key alias> --in <path of the APK file you want to sign> --out <path of the Signed APK file>A sample command is provided below:
apksigner sign --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg C:\Users\riley\Downloads\PKCS11_Wrapper-Windows\pkcs11properties.cfg --ks NONE --ks-type PKCS11 --ks-pass env:KS_PASS --ks-key-alias EC-Cert-020 --in Sample.apk --out signed.apk
After successfully signing the APK, let’s verify it using this command:
apksigner verify -verbose <path of the signed APK file>A sample command is provided below:
apksigner verify -verbose signed.apk
