Java (jarsigner)

Use jarsigner (JDK) to sign JAR files. For current public DigiCert OV/EV code signing, the private key stays on a token or HSM. Configure jarsigner with PKCS #11, not a software .jks that holds the private key.

PKCS #11 config (USB eToken)

Create a config file (for example etoken.cfg). Adjust the library path for your OS and SafeNet version:

name = eToken
library = C:\Windows\System32\eToken.dll
slotListIndex = 0

Linux library paths vary (often under /usr/lib or /usr/lib64 after SafeNet install). Confirm with SafeNet documentation for your build.

Sign:

jarsigner -keystore NONE -storetype PKCS11 \
  -providerClass sun.security.pkcs11.SunPKCS11 \
  -providerArg etoken.cfg \
  -tsa http://timestamp.digicert.com \
  -signedjar SignedApp.jar UnsignedApp.jar "<token-cert-alias>"

You will be prompted for the eToken Password. List aliases if you are unsure:

keytool -list -keystore NONE -storetype PKCS11 \
  -providerClass sun.security.pkcs11.SunPKCS11 \
  -providerArg etoken.cfg

CloudHSM uses a similar PKCS #11 config pointing at the CloudHSM library. See AWS CloudHSM.

Verify

jarsigner -verify -verbose -certs SignedApp.jar

Error: keytool error: java.lang.Exception: Input not an X.509 certificate

This error appears when importing a certificate into a Java keystore with keytool. Typical causes:

  1. Wrong alias — Use the same alias that was used when the CSR (or hardware key) was created. List entries with keytool -list -keystore your_keystore -v.
  2. Wrong file format — The file is not a single X.509 cert or PKCS #7 that keytool accepts. Try PEM/DER of the leaf, or a .p7b with -trustcacerts as documented for your JDK.
  3. Wrong keystore — You must import into the same keystore (or PKCS #11 slot) that holds the matching private key. Importing into a new empty .jks fails.

If the keystore that generated a legacy software CSR is lost, you cannot attach the issued cert to a new key. Reissue or replace the certificate and generate a new hardware-backed key.

For current DigiCert CS on an eToken, prefer PKCS #11 jarsigner above instead of keytool -import into a .jks.

← Back to Sign your code