EV CODESIGNING IN JAVA
This article will be the default article after the implementation of the new Minimum Requirements for Code Signing on February 1, 2017.
This guide assumes that you have already:
- Picked up and installed your certificate onto your security token
- Installed the Java SDK
- Administrative rights may be needed depending on the permissions set to the Java SDK bin folder.
|Please follow these instructions for your signature setup in Java|
- In order to enable the JDK to access the security token, you will first need to create a configuration file. Open any plain-text editor and create a file named eToken.cfg. The file should contain 2, possibly 3, lines:
slot=3* Please see note below.
Note: The default token that GlobalSign Provides is the eToken 5100. The default slot number when left unspecified is 0. SafeNet eToken 5100 will automatically assign to slot 0, therefore there will be no need for the slot line in the .cfg file. However this may need to be changed depending on the number of eTokens / SmartCard readers installed. The default slot number for the SafeNet Ikey 4000 is slot 3. The slot line will be required when using a SafeNet iKey 4000.
- Save this file in the JDK bin folder, by default it is:
???C:\Program Files (x86)\Java\jdk1.7.0_67\bin
- Open the command prompt: Start > Run > cmd
- Navigate to your Java JDK Bin Folder:
|cd C:\Program Files (x86)\Java\jdk1.7.0_67\bin|
- In order to use the token to sign you will need to find the alias of your private key. This will enable you to reference the proper certificate when signing. Run the following command from the bin folder:
keytool -list -keystore NONE -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerArg eToken.cfg
Enter keystore password: “Your Token Password”
Error Note: If you receive the following error: “java.security.KeyStoreException: PKCS11 not found” at this point. There are 2 potential issues with the configuration:
- The Slot Number specified is not the correct slot: To find the proper slot, please set the slot number to zero in your eToken.cfg file (slot=0). Attempt to run the list command again, incrementing the slot number by 1 with each iteration of the error. You should eventually receive the Enter KeyStore Password prompt that will accept your SafeNet Token passphrase. *See: Signature Set Up Step 1.
- Safenet Drivers are not installed correctly. Ensure the proper drivers are installed
- The output is made up of the key alias, the key type, and the certificate fingerprint. We will need the alias of the EV Code Signing certificate to actually sign the fi
|le-d0e453de-66db-414a-8fa8-0a07cfad66b5, PrivateKeyEntry, Certificate fingerprint (SHA1): 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00|
- If there is more than one certificate on your token, you may need to discern which certificate we will be using. Open the Safenet Authentication Client, press the gear icon at the top:
- Find your installed GlobalSign EV Codesigning certificate, and double-click it. This will pull up the certificate details. Select the Details tab, scroll to the bottom and the ThumbPrint will be there:
- Match the certificate thumbprint with the proper alias on your output. In this case it will be the first entry:
|le-d0e453de-66db-414a-8fa8-0a07cfad66b5, PrivateKeyEntry, Certificate fingerprint (SHA1): 7F:31: 00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00|
- Copy the alias (e.g. le-d0e453de-66db-414a-8fa8-0a07cfad66b5) for use in our next command
SIGNING A .JAR FILE
- Now that we have successfully accessed the token and received our certificates alias, we can sign the .jar file. You will need to place the .jar file you are signing into the bin directory
- In the command line, navigate to the Java SDK bin directory, (e.g. C:\Program Files (x86)\Java\jdk1.7.0_67\bin)
The command used to sign is:
|jarsigner -keystore NONE -storetype PKCS11 -tsa http://timestamp.globalsign.com/scripts/timestamp.dll -providerClass sun.security.pkcs11.SunPKCS11 test.jar “le-d0e453de-66db-414a-8fa8-0a07cfad66b5”|
Note: Time stamping your Code is extremely important and is highly recommended for every piece of code that you sign. This timestamp will allow the file that you sign to remain valid long after the certificate itself has expired.
- Warning: The signer’s certificate chain is not validated:
You will need to import the Extended Validation CodeSigning CA – SHA256 – G2 intermediate certificate onto your token to ensure the signature chains properly.
Last Updated: Jan 30, 2017