Complete Process to Codesign and Timestamp a Java (.jar) File

Java is a popular programming language that is used by most organizations to develop business applications. With its high usage, attackers always try to find its vulnerability and exploit its software.

To prevent such exploits, security professionals consider codesigning and timestamping Java files. It prevents attackers from reading the code and exploiting it. You can also effortlessly digitally sign a .jar file through the easy-to-execute steps provided further.

Let’s get started.

The Need to Sign Java Files and Its Prerequisites

The primary of digitally signing Java files is to secure them from unauthorized alterations and align them with system standards. When an operating system finds a digital signature, it doesn’t display an Unknown Publisher Warning to end-users. It also helps boost user confidence, which directly contributes to overall productivity.

Moreover, when you also timestamp a jar file, its validity increases. It tells the system that no one has modified the software after signing. Besides, timestamping also aids in retaining app validity after the expiration of the code signing certificate.

Before you begin:

• Java Code Signing Certificate (installed on a token)
• Correctly installed and configured the SafeNet Authentication Client
• the Java Development Kit (JDK) installed

The Process To Follow For Code Signing And Timestamping

To digitally sign your Java or .jar file, you must follow the below steps:

Step 1: Connect your code signing token to the USB port of your computer.

Step 2: In any line editor (Notepad, for example), create a text file containing the lines below and save it to your JDK bin folder (for example, C:\Program Files (x86)\Java\jre1.8.0_65\bin) as enToken.cfg.

name=enToken
library=c:\WINDOWS\System32\eTPKCS11.dll

Step 3: Open a command prompt. Move to the JDK bin folder. Run the following command to obtain the alias name for the private key:

Keytool -list -keystore NONE -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerArg ./enToken.cfg

You will be prompted for the keystore password. This is the password that you created when you enrolled for the token.

Step 4: To sign JAR file, run the following command:

jarsigner -tsa http://timestamp.digicert.com -keystorec:\path\to\your\keystore.jks -storepass YourPasswordc:\path\to\your\file.jar YourAlias

Step 4: Verify the Signing and Timestamping

 To verify, whether your file gets signed or not, run the following command:

jarsigner -verify -verbose <your JAR filename>

You don’t have to put extra effort into finding a Code Signing Certificate to sign Java files, as SignMyCode has an ideal solution.

Search