Skip to main content

Configure SealSign 2.0 on Linux

The SealSign 2.0 client solution lets you sign multiple documents using a watched folder approach.

Prerequisites

  • Linux operating system

  • DigiCert​​®​​ Document Trust Manager credential ID

  • DigiCert ONE API key or API token authentication certificate

  • Java version 14 or higher

  • SealSign system environment variable

API Key

An API key is a unique identifier generated by the server to authenticate a user or calling program to an API. The API key acts as the first factor of authentication when connecting to DigiCert​​®​​ Document Trust Manager client tools.

To create an API key:

  1. Sign in to DigiCert ONE.

  2. Navigate to the Profile icon > Admin Profile > API tokens.

  3. Select Create API token.

  4. Enter a name for the API token and how long the API key should be valid.

  5. Select Create.

  6. Copy the generated API key and keep it in a safe place.

    Note

    If this is lost, a new API key must be created.

  7. Select Finish.

API token authentication certificate

To generate API token authentication certificate:

  1. Sign in to DigiCert ONE.

  2. Navigate to the Profile icon > Admin Profile > Authentication certificates.

  3. Select Create authentication certificate.

  4. Enter a nickname for the authentication certificate and how long the authentication certificate should be valid.

  5. Select Generate certificate.

  6. Copy the generated certificate's password and keep it in a safe place.

    Note

    The certificate's password is only displayed only once. You cannot access it after you select Download certificate. If you ever lose the password, you will need to generate a new authentication certificate.

  7. Select Download certificate.

  8. Save the authentication certificate to your computer.

    Note

    You cannot download the certificate again. If you don't download the certificate or lose it, you'll need to generate a new authentication certificate.

  9. When ready, select Close.

Credential ID

Your credential ID is the nickname of credential in DigiCert® Document Trust Manager.

To copy your credential ID:

  1. Sign in to DigiCert ONE.

  2. Navigate to DigiCert​​®​​ Document Trust Manager > Credentials.

  3. Hover your cursor over credential nickname.

  4. Select the Copy icon.

Install Java

Download and install latest java 14 or higher before installing the application.

Create SealSign system environment variable

To create new system environment variable on Linux:

  1. Open .bashrc or .bash_profile file in text editor such as vi or nano.

  2. Add this line to the bottom of the file: export SEALSIGN_JAVA_HOME=/path/to/java

    Note

    Replace /path/to/java with path to your Java installation directory.

  3. To encrypt sensitive data, add variable name SEALSIGN_ENCRYPTION_PASSWORD. In the variable value, enter your password which will be used for encryption of sensitive data in configuration file.

    Note

    ('user-api-key' and 'user-pin') must be encrypted in the configuration file if you add this variable name.

  4. Save changes.

  5. To reload the modified environment variables, run command:

    “source ~/.bashrc”

  6. To verify that SEALSIGN_JAVA_HOME variable is set correctly, run command:

    “echo $SEALSIGN_JAVA_HOME”

Install SealSign 2.0

  1. Untar SealSign2_linux_<version>.tar.gz using command:

    “tar -xvzf SealSign2_linux_<version>.tar.gz”

  2. To run SealSign 2.0, run command:

    “sh sealsign2_0.sh start”

  3. To check status, run command:

    “sh sealsign2_0.sh status”

  4. Stop SealSign 2.0, run command:

    “sh sealsign2_0.sh stop”

Configure SealSign 2.0

  1. Open the configuration file: <install folder>/config/sealsign-config.xml

  2. If SEALSIGN_ENCRYPTION_PASSWORD system environment variable is configured, follow below steps for encrypting sensitive data like user-api-key and user-pin:

    1. Download 'Jasypt' Java library and unzip it. (URL: https://github.com/jasypt/jasypt/releases/download/jasypt-1.9.3/jasypt-1.9.3-dist.zip)

    2. Open command prompt and navigate to \jasypt-1.9.3\bin directory.

    3. Execute command:

      encrypt.bat input="" password="" verbose=false

      Arguments:

      a. input – Enter your API key or PIN.

      b. password – Enter previously configured password in SEALSIGN_ENCRYPTION_PASSWORD system environment variable.

      (example: ./encrypt.bat input="PIN" password="PASSWORD")

    4. Use output you receive after executing the above command as value for respective configurations.

      (example: If you receive abcdef as the output after executing ./encrypt.bat input="PIN" password="PASSWORD", add abcdef as the value for user-pin parameter in the configuration below.

  3. Update the configuration file with the values below:

    Sealsignconfig.png

    User configuration

    user-credential-id

    Enter your credential ID.

    user-api-key

    Enter your API key.

    or

    Enter encrypted API key if SEALSIGN_ENCRYPTION_PASSWORD system environment variable is configured.

    auth-mode

    Auth mode. For API token authentication certificate, enter CLIENTCERT. (default: APIKEY)

    user-timezone

    Enter your time zone. (example: CET)

    Server configuration

    url

    Enter your server URL. (example: https://one.digicert.com)

    tsa-url

    Enter the URL of the timestamp authority you will use to sign documents. (example: http://adobe.timestamp.digicert.com/ or http://tsa.quovadisglobal.com/TSS/HttpTspServer or http://ts.quovadisglobal.com/eu)

  4. Restart SealSign 2.0.

Note

Refer to Readme.txt in installation folder for the complete set of configuration parameters and values.

What's next?

Sign with SealSign 2.0.

In this section: