Scripts for signing using KSP library on Jenkins

To register the KSP, open a command prompt and run:

smksp_registrar.exe register

To verify that your KSP is configured properly, and that your client can properly authenticate to the DigiCert​​®​​ KeyLocker service, run:

certutil.exe -csp "DigiCert Software Trust Manager KSP" -key -user

For the client tools to access the private keys in the service through the Key Storage Provider (KSP), your certificates must be synchronized to the local certificate store. Only if the certificate is synchronized, the private key remains stored securely in DigiCert​​®​​ KeyLocker.

To synchronize your certificates to the local certificate store, open a command prompt and run:

smksp_cert_sync.exe

To view the certificates, open Certificate Manager for the user account used to run the certificate sync utility:

certmgr.msc

If you do not see your certificates in the Certificate Manager, verify that you have opened the correct certificate store. There is a different certificate store for each Windows user account.

Operating systems use the environment variable called PATH to determine where executable files are stored on your system. Use the PATH environment variable to store the file path to your signing tools to ensure that the CLI can reference these signing tools.

set PATH=%path%;<path to DigiCert Keylocker Tools>

set PATH=%path%;C:\Program Files\DigiCert\DigiCert Keylocker Tools

The API token is an authentication method used to verify you as a user and your permissions assigned in DigiCert ONE. The API token provides the first factor authentication.

Follow these steps to generate an API token:

The client authentication certificate is an authentication method used to verify you as a user and your permissions assigned in DigiCert ONE. The client authentication certificate provides the second factor authentication.

Follow these steps to create a client authentication certificate:

To sign with SignTool:

stage('sign') {
  steps {
    bat 'signtool.exe sign /csp "DigiCert Signing Manager KSP" /kc "KeypairAlias" /f certificate.crt /tr http://timestamp.digicert.com UNSIGNED.EXE'
}

The input parameters are the alias of the keypair used for signing, the name/alias of the certificate that needs to be used for signing, and the path to the file that needs to be signed.

To sign with Mage:

stage('sign') {
  steps {
    bat 'mage -sign deploy.application -CertFile certificate.crt -KeyContainer KeypairAlias -CryptoProvider “DigiCert Signing Manager KSP” '
}

The input parameters are the path to the file that needs to be signed, the name/alias of the certificate that needs to be used for signing, and the alias of the keypair used for signing.

To sign with NuGet:

stage('sign') {
  steps {
    bat 'nuget sign HelloWorld.1.3.0.17\* -Timestamper http://timestamp.digicert.com -outputdirectory ..\am-HelloWorld.1.3.0.17 -CertificateFingerprint ‎fe509cdc76517a18a37d927e770216b35683d656 -Verbosity detailed -Overwrite'
}

The input parameters are the the path to the file that needs to be signed, the path of the output signed file, and the fingerprint of the certificate that needs to be used for signing.

To sign with Jarsigner:

stage('sign') {
  steps {
    bat 'jarsigner -keystore NONE -storetype Windows-My -signedjar <signed_file>.jar -sigalg SHA256withRSA -digestalg SHA256 <jarfile> <alias>'
}

The input parameters are the path where the signed jar needs to be output, the path to the jar that needs to be signed, and the name/alias of the certificate that needs to be used for signing.

To verify a signature with Jarsigner:

stage('verify') {
  steps {
    bat 'jarsigner -verify <Path to Signed Jar>'
}

To verify a signature with Mage:

stage('verify') {
  steps {
    bat 'mage.exe  -verify deploy.application'
}

To verify a signature with NuGet:

stage('verify') {
  steps {
    bat 'nuget verify -All am-HelloWorld.1.3.0.17\*'
}

To verify a signature with SignTool:

stage('verify') {
 steps {
   bat 'signtool.exe sign verify /v /pa UNSIGNED.EXE'
}