JSign is a versatile, platform-independent tool used for code signing of Windows executable files, installers, and scripts.
To perform Signing using JSign Tool and our PKCS11 Wrapper in Linux (Ubuntu) machine, you would need to follow the below steps:
Go to EC CodeSign Secure’s v3.02’s Signing Tools section and download the PKCS11 Wrapper for Ubuntu.
After that, generate a P12 Authentication certificate from the System Setup > User > Generate Authentication Certificate dropdown.
Go to your Ubuntu client system and edit the configuration files (ec_pkcs11client.ini and pkcs11properties.cfg) downloaded in the PKCS11 Wrapper.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
Now we need to add the environment variable for the pkcs11 client library.
Run the below command to open the bashrc file:
nano ~/.bashrc
Now add the EC_INI_FILE_PATH variable with the path of the .ini at the end of the bashrc file, like:
export EC_INI_FILE_PATH=/home/administrator/PKCS11_Wrapper-Ubuntu/ec_pkcs11client.ini
Press Ctrl+X, then enter Y, and then press Enter to save.
Reload the environment variables
source ~/.bashrc
Check whether the variable has been set correctly
echo $EC_INI_FILE_PATH
NOTE: If you can't see the file location from echo commands, open a new terminal and try again.
Now, you will need to download the latest version of JSign tool (DEB package) in your ubuntu machine using this link.
Install the debian package using the below command:
sudo dpkg --install jsign_7.0_all.deb
To check whether JSign has been properly installed or not, run the following command:
jsign
You will also need to install Java (Java 17 or lower) on your Ubuntu machine for JSign to work with our PKCS11 Wrapper.
Run the following command to install Java 17 on your Ubuntu machine
sudo apt install openjdk-17-jdk
To use Java 17, you will need to set it as the active version.
sudo update-alternatives --config java
Now to check whether Java has been installed properly or not, run:
java -version
NOTE: If "sudo apt-get install liblog4cxx12" command gives error, run the following steps to install this package
For amd architecture:
For arm architecture:
We are now ready with our Ubuntu environment to perform the signing using JSign tool and PKCS11 Wrapper
For Signing, change the working directory of the terminal to that folder which contains your "ec_pkcs11client.ini" file.
Now, run the signing command from this directory.
<Path of JSign tool> --keystore <Path of pkcs11properties.cfg> --storepass NONE --storetype PKCS11 --alias <Key alias of the signing certificate> <Path of the file to be signed>
A sample command is provided below:
jsign --keystore pkcs11properties.cfg --storepass NONE --storetype PKCS11 --alias EC-Cert-020 build_project.ps1
NOTE: There is no verification command for JSign tool.
To perform Signing using JSign Tool and our PKCS11 Wrapper in MacOS machine, you would need to follow the below steps:
For "pkcs11properties.cfg", update the library path.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
For "ec_pkcs11client.ini" file, update the following fields:
You will also need to install Java (Java 17 or lower) on your MacOS machine for JSign to work with our PKCS11 Wrapper.
To install Java 17 on your MacOS machine, run the following command:
brew install openjdk@17
Find the location where Java 17 is installed on your machine:
brew info openjdk@17
Now set Java 17 as the active version.
For Zsh: nano ~/.zshrc
For Bash: nano ~/.bash_profile
After running the above command, add these lines:
Reload the environment variables using the below commands:
For Zsh: source ~/.zshrc
For Bash: source ~/.bash_profile
Now, you will need to download the latest version of JSign tool (JAR package) in your MacOS machine using this link.
To check whether JSign has been properly installed or not, run the following command:
java -jar <Path of JSign Jar Package>
We are now ready with our MacOS environment to perform the signing using JSign tool and PKCS11 Wrapper
For Signing, change the working directory of the terminal to that folder which contains your "ec_pkcs11client.ini" file.
Now, run the signing command from this directory.
java -jar <Path of JSign tool> --keystore <Path of pkcs11properties.cfg> --storepass NONE --storetype PKCS11 --alias <Key alias of the signing certificate> <Path of the file to be signed>
A sample command is provided below:
java -jar jsign-7.0.jar --keystore pkcs11properties.cfg --storepass NONE --storetype PKCS11 --alias EC-Cert-020 build_project.ps1
NOTE: There is no verification command for JSign tool.
To perform signing using JSign Tool and our PKCS11 Wrapper in Windows machine, you would need to follow the below steps:
Go to EC CodeSign Secure’s v3.02’s Signing Tools section and download the PKCS11 Wrapper for Windows.
After that, generate a P12 Authentication certificate from the System Setup > User > Generate Authentication Certificate dropdown.
Go to your Windows client system and edit the configuration files (ec_pkcs11client.ini and pkcs11properties.cfg) downloaded in the PKCS11 Wrapper.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
Now, let’s install some prerequisites in your client system to run the PKCS11 Wrapper.
NOTE: Windows requires Java 22, unlike the Linux and macOS tracks above which use Java 17 or lower.
Install Java 22 from Oracle’s official site, and follow the instructions in the msi file.
Set Java 22 as the active version by storing the bin path in the PATH variable.
Now, you will need to download the latest version of JSign tool (JAR package) in your Windows machine using this link.
To check whether JSign has been properly installed or not, run the following command:
java -jar <Path of JSign Jar Package>
We are now ready with our Windows environment to perform the signing using JSign tool and PKCS11 Wrapper
For Signing, change the working directory of the terminal to that folder which contains your "ec_pkcs11client.ini" file.
Now, run the signing command from this directory.
java -jar <Path of JSign tool> --keystore <Path of pkcs11properties.cfg> --storepass NONE --storetype PKCS11 --alias <Key alias of the signing certificate> <Path of the file to be signed>
A sample command is provided below:
java -jar jsign-7.0.jar --keystore pkcs11properties.cfg --storepass NONE --storetype PKCS11 --alias EC-Cert-020 build_project.ps1
NOTE: There is no verification command for JSign tool.