Breadcrumbs

Sign with JAR Signatures

The Java Archive (JAR) format is used to package Java applications and libraries. SignServer signs JAR files using the JArchive Signer, which embeds a CMS signature directly into the archive. Signed JAR files can optionally include a timestamp from a TSA using the RFC 3161 format.

JArchive Signer Configuration Properties

The following properties are most relevant when configuring the JArchive Signer:

Property

Description

DIGESTALGORITHM

Algorithm for the digest of the file entries and the manifest. Example: SHA-256

KEEPSIGNATURE

Set to true to preserve any existing signature files in the JAR.

REPLACESIGNATURE

Set to true to overwrite an existing signature with the same name instead of failing with an error.

SIGNATUREALGORITHM

The algorithm used to sign the data. Example: SHA256withRSA

SIGNATURE_NAME_TYPE

The source of the signature name. VALUE uses the value of SIGNATURE_NAME_VALUE. KEYALIAS uses the alias of the signing key.

Example: KEYALIAS.

TSA_URL

URL of an external TSA to use for timestamping. Example: https://tsa.example.com/authenticode

TSA_WORKER

Worker ID or name of an internal timestamp Signer within the same SignServer instance. Example: TimeStampSigner1

ZIPALIGN

Set to true to align each file entry's data to a 4-byte offset. Use this for Android apps.

For all available properties, see JArchive Signer.

Set up the JAR Signer

Step 1 – Add and Configure the Signer

  1. Open the Admin Web, and go to the Workers page.

  2. Click Add, and select From Template.

  3. Choose jarchive_signer.properties, and click Next.

  4. Click Apply.

  5. Select the Worker named JArchiveSigner in the list.

  6. Click the Configuration tab and update the following properties:

    • NAME: Set a descriptive name for the worker.

    • CRYPTOTOKEN: set this to match your Crypto Token.

  7. Click the Status Summary tab, and click Renew Key.

  8. Select a Key Algorithm (for example, RSA) and Key Specification (for example, 2048), and click Generate.

Step 2 - Generate a CSR and Install the Certificate

  1. Choose a Signature Algorithm, for example, SHA256withRSA, and enter a Subject DN for the certificate, for example, CN=JAR Signer Test,O=My Company,C=SE.

  2. Click Generate.

  3. Click Download and save the CSR file.

  4. Submit the CSR to your Certificate Authority. The CA returns the signed certificate and any CA certificates in the chain.

Before installing certificates in a production system, verify the authorization settings of the Signer. Once certificates are installed, the Signer is fully active and ready to accept signing requests.

  1. Click Install certificates. Provide the Signer certificate first, then add the issuing CA certificates in order. Click Add for each certificate to append it to the chain.

  2. When all certificates are in the correct order, click Install.

  3. Confirm the Worker status is Active. If not, check the Status Summary page for errors.

Sign a JAR File

You can submit files for signing using the Client Web, the SignClient, or HTTP clients like cURL.

You can download a sample JAR to test with: helloworld.jar

Using Client Web

  1. Go to the SignServer Client Web Generic page.

  2. Scroll down to the Generic Signing Or Validation by File Upload section and specify your Worker name, for example JArchiveSigner, in the Worker Name field.

  3. Click Choose File, select your JAR file, for example, helloworld.jar.

  4. Click Submit.

  5. Save the returned signed JAR file.

Using SignClient

Send a signing request using the SignServer SignClient:

Bash
bin/signclient signdocument -workername JArchiveSigner -infile helloworld.jar -outfile helloworldsigned.jar

Where workername is your Worker name, infile is the path to the unsigned JAR, and outfile is where the signed JAR will be written.

Using cURL

Replace http://localhost:8080/ with the address of your server or appliance:

curl -F "workerName=JArchiveSigner" -F "file=@helloworld.jar" \
  http://localhost:8080/signserver/process > helloworld-signed.jar

Verify the Signature

Use the jarsigner tool, included in the Java Development Kit (JDK), to verify a signed JAR file.

After installing the JDK, execute the command as a user, with the path to the signed file:

jarsigner -verify -strict helloworld-signed.jar

To also display the signing certificates and additional details, add the -verbose -certs options:

jarsigner -verify -strict -verbose -certs helloworld-signed.jar