Jarsigner is a command-line tool within the Java Development Kit (JDK) used for digitally signing Java Archive (JAR) files.
To perform Signing using Jarsigner Tool and our PKCS11 Wrapper in Linux (Ubuntu) machine, you would need to follow the below steps:
Go to EC CodeSign Secure’s v3.02’s Signing Tools section and download the PKCS11 Wrapper for Ubuntu.
After that, generate a P12 Authentication certificate from the System Setup > User > Generate Authentication Certificate dropdown.
Go to your Ubuntu client system and edit the configuration files (ec_pkcs11client.ini and pkcs11properties.cfg) downloaded in the PKCS11 Wrapper.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
Now we need to add the environment variable for the pkcs11 client library.
Run the below command to open the bashrc file:
nano ~/.bashrc
Now add the EC_INI_FILE_PATH variable with the path of the .ini at the end of the bashrc file, like:
export EC_INI_FILE_PATH=/home/administrator/PKCS11_Wrapper-Ubuntu/ec_pkcs11client.ini
Press Ctrl+X, then enter Y, and then press Enter to save.
Reload the environment variables
source ~/.bashrc
Check whether the variable has been set correctly
echo $EC_INI_FILE_PATH
NOTE: If you can't see the file location from echo commands, open a new terminal and try again.
You will also need to install Java (Java 8-17) on your Ubuntu machine for Jarsigner to work with our PKCS11 Wrapper.
Run the following command to install Java 17 on your Ubuntu machine
sudo apt install openjdk-17-jdk
To use Java 17, you will need to set it as the active version.
sudo update-alternatives --config java
Now to check whether Java has been installed properly or not, run:
java -version
Set the JAVA_HOME environment variable:
nano ~/.bashrc
After running the above command, add these lines at the end of the file:
Press Ctrl + X, then Y to confirm, and then Enter to save.
Reload the bashrc file using the below command
source ~/.bashrc
Check if the variable has been set
echo $JAVA_HOME
If not, then open a new terminal and try again.
NOTE: If "sudo apt-get install liblog4cxx12" command gives error, run the following steps to install this package
For amd architecture:
For arm architecture:
We are now ready with our Ubuntu environment to perform the signing using Jarsigner tool and PKCS11 Wrapper
For Signing, change the working directory of the terminal to that folder which contains your "ec_pkcs11client.ini" file.
Now, run the signing command from this directory.
<Path of Jarsigner tool> -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg <Path of pkcs11properties.cfg> -signedjar <Path of the file after signing> <Path of the file to be signed> <Key alias of the signing certificate> -tsa http://timestamp.digicert.com
A sample command is provided below:
jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties.cfg -signedjar helloworld_signed.jar helloworld.jar EC-Cert-020 -tsa http://timestamp.digicert.com
Note: Replace EC-Cert-020 with the key label (alias) of your signing certificate. With an ECDSA key, use -sigalg SHA256withECDSA.
For Verification, run the following command:
<Path of Jarsigner tool> -verify <Path of the file after signing> -certs -verbose
A sample command is provided below:
jarsigner -verify helloworld_signed.jar -certs -verbose
To perform signing using Jarsigner and our PKCS11 Wrapper in MacOS machine, you would need to follow the below steps:
For "pkcs11properties.cfg", update the library path.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
For "ec_pkcs11client.ini" file, update the following fields:
You will also need to install Java (Java 8-17) on your MacOS machine for Jarsigner to work with our PKCS11 Wrapper.
To install Java 17 on your MacOS machine, run the following command:
brew install openjdk@17
Find the location where Java 17 is installed on your machine:
brew info openjdk@17
Now set Java 17 as the active version.
For Zsh: nano ~/.zshrc
For Bash: nano ~/.bash_profile
After running the above command, add these lines:
Reload the environment variables using the below commands:
For Zsh: source ~/.zshrc
For Bash: source ~/.bash_profile
We are now ready with our MacOS environment to perform the signing using Jarsigner tool and PKCS11 Wrapper
For Signing, change the working directory of the terminal to that folder which contains your "ec_pkcs11client.ini" file.
Now, run the signing command from this directory.
<Path of Jarsigner tool> -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg <Path of pkcs11properties.cfg> -signedjar <Path of the file after signing> <Path of the file to be signed> <Key alias of the signing certificate> -tsa http://timestamp.digicert.com
A sample command is provided below:
jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties.cfg -signedjar helloworld_signed.jar helloworld.jar EC-Cert-020 -tsa http://timestamp.digicert.com
For Verification, run the following command:
<Path of Jarsigner tool> -verify <Path of the file after signing> -certs -verbose
A sample command is provided below:
jarsigner -verify helloworld_signed.jar -certs -verbose
To perform signing using Jarsigner Tool and our PKCS11 Wrapper in Windows machine, you would need to follow the below steps:
Go to EC CodeSign Secure’s v3.02’s Signing Tools section and download the PKCS11 Wrapper for Windows.
After that, generate a P12 Authentication certificate from the System Setup > User > Generate Authentication Certificate dropdown.
Go to your Windows client system and edit the configuration files (ec_pkcs11client.ini and pkcs11properties.cfg) downloaded in the PKCS11 Wrapper.
NOTE: When using Luna HSM, add the slot number in the pkcs11properties.cfg file as shown below:
Now, let’s install some prerequisites (Java 8-22) in your client system to run the PKCS11 Wrapper.
NOTE: Windows requires Java 22, unlike the Linux and macOS tracks above which use Java 8-17.
Install Java 22 from Oracle’s official site, and follow the instructions in the msi file.
Set Java 22 as the active version by storing the bin path in the PATH variable.
We are now ready with our Windows environment to perform the signing using Jarsigner tool and PKCS11 Wrapper
For Signing, change the working directory of the terminal to that folder which contains your "ec_pkcs11client.ini" file.
Now, run the signing command from this directory.
<Path of Jarsigner tool> -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg <Path of pkcs11properties.cfg> -signedjar <Path of the file after signing> <Path of the file to be signed> <Key alias of the signing certificate> -tsa http://timestamp.digicert.com
A sample command is provided below:
jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties.cfg -signedjar helloworld_signed.jar helloworld.jar EC-Cert-020 -tsa http://timestamp.digicert.com
For Verification, run the following command:
<Path of Jarsigner tool> -verify <Path of the file after signing> -certs -verbose
A sample command is provided below:
jarsigner -verify helloworld_signed.jar -certs -verbose