Scripts for signing using PKCS11 library on Gradle

DigiCert​​®​​ Software Trust Manager clients can be downloaded in a package.

set PATH=%path%;<path to DigiCert One Signing Manager Tools>

set PATH=%path%;C:\Program Files\DigiCert\DigiCert One Signing Manager Tools

Software Trust Manager enforces multifactor authentication for security. To access keypairs, certificates, and sign code, you need to set up two types of credentials: an API token and an authentication certificate.

Set the following environment variables:

Your DigiCert ONE host environment, API key, client authentication certificate, and password make up your environment variables and are required to access Software Trust Manager client tools. Use one of the methods provided below to securely store your credentials based on your operating system.

Create test keypair and certificate

An example for a Gradle setup to generate an RSA test keypair with certificate:

task createKeypair(type: Exec, description: 'create test keypair using DigiCert Signing Manager pkcs11', group: 'Build') {
  def keyType = "TEST"
  def certAlias = "<CertAlias>"
  def operation = "generate"
  def keyPair = "keypair"
  def keyAlg = "<keyAlg>"
  def generateCert = "true"
  def certProfileId="<CertProfileId>"
  def alias = "<KeyPairAlias>"
  commandLine "C:/smtools/smctl.exe", keyPair, operation, keyAlg, "--cert-alias", certAlias, "--cert-profile-id", certProfileId, "--generate-cert", generateCert, "--key-type", keyType
}

The keypair name and certificate name are must be unique inputs, meaning that they cannot exist on the portal already.

The certificate profile ID to be used can be retrieved from the DigiCert One portal at DigiCert​​®​​ Software Trust Manager > Certificates > Certificate profiles. Select a profile (Profile Category should be Test) that you want to generate the certificate with, and you should see the profile ID.

Create production keypair with certificate

An example of a Gradle setup to generate an RSA production keypair with certificate:

task createKeypair(type: Exec, description: 'create production keypair using DigiCert Signing Manager pkcs11', group: 'Build') {
  def keyType = "PRODUCTION"
  def certAlias = "<certAlias>"
  def operation = "generate"
  def keyPair = "keypair"
  def keyAlg = "<keyAlg>"
  def generateCert = "true"
  def certProfileId="<certProfileId>"
  def alias = "<leyPairAlias>"
  commandLine "C:/smtools/smctl.exe", keyPair, operation, keyAlg, "--cert-alias", certAlias, "--cert-profile-id", certProfileId, "--generate-cert", generateCert, "--key-type", keyType
}

The parameters are the same as the previous case, but care should be taken to select a certificate profile that has the profile category as Production.

Create a certificate from an existing keypair

An example of a Gradle setup to generate a certificate for an existing keypair:

task createCertForKeypair(type: Exec, description: 'create certificate for existing keypair using DigiCert Signing Manager pkcs11', group: 'Build') {
  def keyType = "PRODUCTION"
  def certAlias = "<certAlias>"
  def operation = "generate-cert"
  def keyPair = "keypair"
  def keyPairID = "<keyPairId>"
  def certProfileId="<certProfileId>"
  def setAsDefault = "true"
  commandLine "C:/smtools/smctl.exe", keyPair, operation, keyPairID, "--cert-alias", certAlias, "--cert-profile-id", certProfileId, "--set-as-default-cert", setAsDefault, "--key-type", keyType
}

For this step, the inputs required are a keypair ID, certificate name (which should be unique) and certificate profile ID. You can retrieve the keypair ID in two ways:

Also, as in the previous use cases, the certificate profile ID used should belong to the correct profile category.

To integrate DigiCert​​®​​ Software Trust Manager PKCS11 with Gradle implementation, add the code snippet to the build.gradle file:

plugins {
    // Apply the java-library plugin for API and implementation separation.
    id 'java'
}

task sign(type: Exec, dependsOn: 'jar', description: 'jar signing using DigiCert Signing Manager pkcs11', group: 'Build') {
  def storePassword = "NONE"
  def keyStore = "NONE"
  def storeType = "PKCS11"
  def providerClass = "sun.security.pkcs11.SunPKCS11"
  def providerArg = "<Path to smpkcs11.config>"
  def alias = "<keypair alias>"
  def signedjarfile = "<Path of signed file>"
  def unsignedjarfile=""<Path of unsigned file>""
  commandLine "${System.env.JAVA_HOME}/bin/jarsigner.exe", "-keystore", keyStore, "-storepass", storePassword, "-storetype", storeType,  "-providerClass", providerClass, "-providerArg", providerArg, "-signedjar", signedjarfile, "-unsignedjarfile", unsignedjarfile, alias
}

The input parameters for the example are the path to the alias of the keypair, the configuration file, the path where the signed jar needs to be output, the path to the jar that needs to be signed, and the name of the certificate that needs to be used for signing.

An example of a Gradle setup that verifies a signed jar:

plugins {
    // Apply the java-library plugin for API and implementation separation.
    id 'java'
}

task verify(type: Exec, dependsOn: 'jar', description: 'jar verification using DigiCert Signing Manager pkcs11', group: 'Build') {
  def signedjarfile = ""<Path of signed file>""
  commandLine "${System.env.JAVA_HOME}/bin/jarsigner.exe", "-verify", signedjarfile
}

The only input for this stage is the path to the signed jar that needs to be verified.

Troubleshooting