Skip to main content

jarsignerと keytool-PKCS11を設定する

Jarsigner is a command-line tool and JCE is a framework within the Java Development Kit (JDK). It is used to digitally sign Java Archive (JAR) files and other related artifacts.

ヒント

Signing with JCE is recommended over PKCS11 and KSP library options because it is:

  • Compatible with any operating system that supports Java (Windows, Linux, macOS, Solaris, and AIX)

  • Compatible with any Java architecture, including: 64-bit, 32-bit, and ARM processors.

Follow these instructions to sign directly using Jarsigner, JCE and securely reference your private key stored in DigiCert​​®​​ KeyLocker.

Prerequisites

  • Download JCE library

  • Install JDK or OpenJDK (compatible with version 8 and higher)

    注記

    Testing for EdDSA signature generation requires Java version 15 or higher.

  • Configure your credentials

    注記

    Your API key and client authentication certificate password must be provided using one of the following methods:

    • Session-based environment variables.

    • Persistent environment variables.

  • Keypair alias

  • Unsigned jar file

What files can Jarsigner sign using the JCE library?

  • .jar

  • .ear

  • .sar

  • .war

jarsignerと keytool の共通パラメータ

パラメータは大文字と小文字を区別し、jarsignerと keytool への各リクエストで渡さなければなりません。

1. jarsignerと keytool の共通パラメータ

パラメータ

-keystore

none

-storepass

none

-storetype

PKCS11

-providerclass

com.digicert.jce.Provider


jarsignerコマンド (PKCS11)

例では Java JDK 1.8 を使用していますが、当社は JDK 1.6-1.11+ をサポートしています。ただし、インストールされている JDKのバージョンにより、パラメータが異なる場合があります。

注記

The parameters may vary depending on which JDK version is installed.

To list jarsigner parameters, run:

jarsigner

Sign

To sign, run:

Verify signature

To verify if a file is signed, run:

jarsigner -verify "<path to signed jar file>" -certs -verbose           

注記

To return more details, include -certs -verbose as an optional parameters.

Sample command:

jarsigner -verify "C:\Users\Name\Desktop\Signed\example.jar"