Jarsigner is a command-line tool provided as part of the Java Development Kit (JDK). It is used to digitally sign Java Archive (JAR) files and other related artifacts.
Follow these instructions to sign directly using Jarsigner and securely reference your private key stored in DigiCert® KeyLocker. Alternatively, integrate Jarsigner with Signing Manager Controller (SMCTL) for simplified signing.
Compatible with Windows, Linux, and macOS
Download and configure DigiCert® KeyLocker clients
Install JDK or OpenJDK (compatible with version 8-17)
Unsigned jar file
.jar
.ear
.sar
.war
The examples shown for the commands below use Java JDK 8, however DigiCert® KeyLocker supports JDK versions 8-17.
Nota
The parameters may vary depending on which JDK version is installed.
To list jarsigner parameters, run:
jarsigner
To sign, run:
jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg <path to pkcs11properties.cfg> -signedjar <path to signed file output>
<unsigned file path> <keypair alias> -tsa http://timestamp.digicert.com
Sample command:
jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties2.cfg -signedjar C:\\Users\\Name\\Desktop\\signed\\signedjar.jar C:\\Users\\Name\\Desktop\ToSign\\jartosign.jar key3 -tsa "http://timestamp.digicert.com"
To verify if a file is signed, run:
jarsigner -verify "<path to signed jar file>" -certs -verbose
Nota
To return more details, include -certs -verbose
as an optional parameters.
Sample command:
jarsigner -verify "C:\Users\Name\Desktop\Signed\example.jar"