JARSIGNER(1) JDK Commands JARSIGNER(1) (NAME) jarsigner - (JAR) (SYNOPSIS) jarsigner [options] jar-file alias jarsigner -verify [options] jar-file [alias ...] options . Options for jarsigner . -verify -verify JAR (alias) keystore . -verify jarsigner JAR keystore . keystore -keystore keystore . -strict jarsigner <> . jar-file JAR . -strict jarsigner <> . alias keystore -keystore keystore . (DESCRIPTION) jarsigner : o (JAR). o JAR . JAR . jar JAR . ( ZIP JAR JAR jar jarsigner META-INF/MANIFEST.MF .) ( ) ( ) . : o . o . o . o . . / . (certificate) . jarsigner keystore JAR . keystore X.509 . keytool keystore . jarsigner . JAR keystore . jarsigner JAR ( ) . jarsigner (timestamp) JAR . (API) . jarsigner JAR jar zip . JAR zip META-INF/MANIFEST.MF . jarsigner zip META-INF/MANIFEST.MF . jarsigner JAR zip . JAR -verify . jarsigner . -revCheck . . -strict . Errors and Warnings ..SH " (KEYSTORE ALIASES)" (keystore) (alias) . jarsigner JAR . JAR JAR . . . . (KEYSTORE LOCATION) jarsigner -keystore URL . .keystore user.home . OS X: user.home . -keystore KeyStore.load . NONE URL null KeyStore.load . NONE KeyStore (hardware token) . (KEYSTORE IMPLEMENTATION) KeyStore java.security (interface) . (concrete) . (keytool jarsigner). PKCS12 . RSA PKCS12 Personal Information Exchange Syntax . . Oracle . () JKS . ( ) . (provider- based) KeyStore (Service Provider Interface SPI) . KeystoreSpi java.security . (provider) Java Security API . KeystoreSpi How to Implement a Provider in the Java Cryptography Architecture [https://www.oracle.com/pls/topic/lookup?ctx=en/java/javase/11/tools&id=JSSEC-GUID-2BCFDD85-D533-4E6C-8CE9-29990DEB0190] . getInstance KeyStore . . . jarsigner URL . MSCAPI Windows PKCS11 . jarsigner keytool -storetype . keystore.type . java.security JDK java.home/conf/security . keystore.type . . KeyStore getDefaultType keystore.type . keystore.type : KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); pkcs12 RSA PKCS12 Personal Information Exchange Syntax . : keystore.type=pkcs12 . JKS jks . . jks Oracle : keystore.type=jks jarsigner JAR : keyalg keysize sigalg ----------------------------------------------------------------------------------- DSA SHA256withDSA .DSA RSA <= 3072 SHA256withRSA .RSA <= 7680 SHA384withRSA > 7680 SHA512withRSA EC < 384 SHA256withECDSA .EC < 512 SHA384withECDSA = 512 SHA512withECDSA RSASSA-PSS <= 3072 RSASSA-PSS ( .RSA SHA-256) <= 7680 RSASSA-PSS ( SHA-384) > 7680 RSASSA-PSS ( SHA-512) EdDSA 255 Ed25519 .EC 448 Ed448 o RSASSA-PSS jarsigner . jarsigner . 3072- RSASSA-PSS RSASSA-PSS SHA-256 () MGF1 . -sigalg . jarsigner jdk.jar.disabledAlgorithms jdk.security.legacyAlgorithms . JAR JAR . JAR (legacy) . -J-Djava.security.debug=jar . jdk.jar.disabledAlgorithms jdk.security.legacyAlgorithms java.security ( $JAVA_HOME/conf/security JDK) . : JDK . JDK -sigalg ..SH " JAR (THE SIGNED JAR FILE)" jarsigner JAR JAR JAR META-INF : o .SF o .DSA .RSA .EC -sigfile . -sigfile MKSIGN MKSIGN.SF MKSIGN.RSA . RSA . -sigfile .SF (alias) . . (_) . (-) . (SIGNATURE FILE) ( .SF) manifest jarsigner JAR . JAR .SF manifest : o o (SHA) o SHA : (SHA) SHA . manifest SHA () . .SF manifest . manifest . manifest . . JAR File Verification . (SIGNATURE BLOCK FILE) .SF . keystore . .DSA .RSA .EC . Supported Algorithms . (SIGNATURE TIME STAMP) jarsigner JAR : o -tsa url o -tsacert alias o -tsapolicyid policyid o -tsadigestalg algorithm Options for jarsigner ..SH " JAR (JAR FILE VERIFICATION)" JAR JAR . JAR : 1. .SF. ( ) . (.SF) .SF . 2. (digest) .SF . .SF . . . .SF . Signature File . .SF . ( jar) JAR .SF . JAR ( jarsigner ) .SF .SF . JAR . .SF . 3. JAR .SF . (digest) . . (security exception) . jarsigner . 4. . Supported Algorithms . : ( -strict) ( -verbose -certs) . JAR (MULTIPLE SIGNATURES FOR A JAR FILE) JAR jarsigner (alias) : jarsigner myBundle.jar susan jarsigner myBundle.jar kevin JAR .SF JAR . JAR : SUSAN.SF SUSAN.RSA KEVIN.SF KEVIN.RSA jarsigner . : o (-) . o . o ( ) . o -storepass -keypass -sigfile -sigalg -digestalg -signedjar TSA JAR JAR . -keystore JAR . (alias) JAR . -keystore url (URL) keystore . .keystore user.home . keystore . keystore keystore . keystore keystore -verbose JAR keystore . -keystore URL URL :file . : o -keystore filePathAndName o -keystore file:filePathAndName Sun PKCS #11 java.security ( $JAVA_HOME/conf/security JDK) keytool jarsigner PKCS #11 : -keystore NONE -storetype PKCS11 PKCS#11 : keytool -keystore NONE -storetype PKCS11 -list -storepass [:env | :file] argument keystore . ( ) JAR . -storepass . env file argument . : o env: argument. o file: argument. : . -storetype storetype keystore . keystore keystore.type getDefaultType java.security.KeyStore . PIN PKCS #11 -storepass . keytool jarsigner PIN . ( PIN ) -protected . -keypass [:env | :file] argument -certchain file keystore . jarsigner JAR . (store password) . env file argument . : o env: argument. o file: argument. : . -certchain file keystore ( ) . keystore . X.509 PKCS#7 ( Base64 ) Internet RFC 1421 Certificate Encoding Standard [http://tools.ietf.org/html/rfc1421]. -sigfile file .SF . file DUKESIGN .SF DUKESIGN.SF DUKESIGN.RSA META-INF JAR . a-zA-Z0-9_- . (_) (-) . .SF . -sigfile .SF . . (_) . -signedjar file JAR . -digestalg algorithm (message digest) JAR . Java Security Standard Algorithm Names ..PP SHA256 . -addprovider -providerClass . -sigalg algorithm JAR . JAR . Supported Algorithms . -addprovider -providerClass . Java Security Standard Algorithm Names . -verify JAR . -verbose[:suboptions] -verbose jarsigner (verbose) . jarsigner JAR . suboptions all grouped summary . -certs ( all) JAR . -certs -verbose:grouped . -certs -verbose:summary . one entry (and more) . Example of Verifying a Signed JAR File Example of Verification with Certificate Information . -certs -certs -verify -verbose JAR . ( ) X.509 ( java.security.cert.X509Certificate) (distinguished name) . keystore . keystore keystore ( ) . keystore keystore . -revCheck JAR . -revCheck jarsigner OCSP CRL . . -tsa url -tsa http://example.tsa.url JAR . http://example.tsa.url (TSA) -tsacert . -tsa TSA keystore . jarsigner (TSP) RFC 3161 TSA . TSA . -tsacert alias -tsacert alias JAR . TSA keystore . Subject Information Access TSA . -tsacert TSA keystore . -tsapolicyid policyid (OID) TSA . TSA . X.696 ITU ( ITU-T) . 1.2.3.4. -tsadigestalg algorithm (message imprint) TSA . SHA-256 . Supported Algorithms . Java Security Standard Algorithm Names . -internalsf JAR .SF ( ) . . JAR .SF . -internalsf . . -internalsf . -sectionsonly -sectionsonly .SF ( ) JAR manifest . JAR . Signature File . . JAR manifest . . .SF manifest . JAR File Verification ..PP -sectionsonly . . -protected true false . true . -providerName providerName java.security -providerName . . Oracle PKCS #11 providerName SunPKCS11-TokenName TokenName . PKCS #11 SmartCard : jarsigner -keystore NONE -storetype PKCS11 -providerName SunPKCS11-SmartCard -list -addprovider name [-providerArg arg] ( SunPKCS11) . . -providerArg ConfigFilePath keytool jarsigner ConfigFilePath . PKCS #11 Oracle PKCS #11 . jarsigner -keystore NONE -storetype PKCS11 -addprovider SunPKCS11 -providerArg /mydir1/mydir2/token.config -providerClass provider-class-name [-providerArg arg] java.security . (fully-qualified) . : PKCS11 . -addprovider . -Jjavaoption javaoption Java . jarsigner (wrapper) . . . java -h java -X . -strict . . (Errors and Warnings) . -conf url . keytool . "jarsigner.all" "jarsigner.sign" "jarsigner.verify" . jarsigner JAR () . jarsigner JDK 9 JDK . -altsigner class . (fully qualified class name) com.sun.jarsigner.ContentSigner . -altsignerpath . -altsigner jarsigner . jarsigner . com.sun.sun.jarsigner.AuthSigner -altsigner com.sun.jarsigner.AuthSigner jarsigner . -altsignerpath classpathlist JAR . -altsigner . JAR JAR . . classpathlist JAR : o (:) Linux macOS o (;) Windows . JAR . JAR . -altsignerpath /home/user/lib/authsigner.jar JAR . JAR . -altsignerpath /home/user/classes/com/sun/tools/jarsigner/ (ERRORS AND WARNINGS) jarsigner . jarsigner . -strict jarsigner -strict OR . . KeyUsage -strict jarsigner 12 (=4+8) . : ( ) Linux OS X 0 255 . jarsigner ..SH " (FAILURE)" jarsigner ( ) JAR JAR . failure 1. . (SEVERE WARNINGS) : -strict . jarsigner JAR JAR . hasExpiredCert 4. JAR . hasExpiredTsaCert 4. . notYetValidCert 4. JAR . chainNotValidated 4. JAR . tsaChainNotValidated 64. . signerSelfSigned 4. JAR . disabledAlg 4. . badKeyUsage 8. JAR KeyUsage . badExtendedKeyUsage 8. JAR ExtendedKeyUsage . badNetscapeCertType 8. JAR NetscapeCertType . hasUnsignedEntry 16. JAR . notSignedByAlias 32. JAR () . aliasNotInStore 32. JAR keystore . tsaChainNotValidated 64. JAR TSA . . . extraAttributesDetected POSIX / (symlink) JAR . jarsigner . hasExpiringCert JAR . hasExpiringTsaCert (timestamp) YYYY-MM-DD . internalInconsistenciesDetected JAR JarFile JarInputStream . legacyAlg . noTimestamp JAR . (YYYY-MM-DD) JAR . JAR (EXAMPLE OF SIGNING A JAR FILE) bundle.jar keystore jane keystore mystore working JAR sbundle.jar : jarsigner -keystore /working/mystore -storepass keystore_password -keypass private_key_password -signedjar sbundle.jar bundle.jar jane -sigfile .SF JAR . JANE.SF JANE.RSA . store ( ) : jarsigner -keystore /working/mystore -signedjar sbundle.jar bundle.jar jane keystore keystore (.keystore ) keystore : jarsigner -signedjar sbundle.jar bundle.jar jane JAR JAR (bundle.jar) -signedjar : jarsigner bundle.jar jane JAR JAR : jarsigner -verify ButtonDemo.jar jar verified . . -verbose . jarsigner -verbose : jarsigner -verify -verbose ButtonDemo.jar s 866 Tue Sep 12 20:08:48 EDT 2017 META-INF/MANIFEST.MF 825 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.SF 7475 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.RSA 0 Tue Sep 12 20:07:54 EDT 2017 META-INF/ 0 Tue Sep 12 20:07:16 EDT 2017 components/ 0 Tue Sep 12 20:07:16 EDT 2017 components/images/ sm 523 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo$1.class sm 3440 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.class sm 2346 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.jnlp sm 172 Tue Sep 12 20:07:16 EDT 2017 components/images/left.gif sm 235 Tue Sep 12 20:07:16 EDT 2017 components/images/middle.gif sm 172 Tue Sep 12 20:07:16 EDT 2017 components/images/right.gif s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore - Signed by "CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US" Digest algorithm: SHA-256 Signature algorithm: SHA256withRSA, 2048-bit key Timestamped by "CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US" on Tue Sep 12 20:08:49 UTC 2017 Timestamp digest algorithm: SHA-1 Timestamp signature algorithm: SHA1withRSA, 2048-bit key jar verified. The signer certificate expired on 2018-02-01. However, the JAR will be valid until the timestamp expires on 2020-12-29. (EXAMPLE OF VERIFICATION WITH CERTIFICATE INFORMATION) -certs -verify -verbose JAR . (distinguished name) ( X.509 ) (alias) keystore ( JAR keystore ) : jarsigner -keystore $JAVA_HOME/lib/security/cacerts -verify -verbose -certs ButtonDemo.jar s k 866 Tue Sep 12 20:08:48 EDT 2017 META-INF/MANIFEST.MF >>> Signer X.509, CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US [certificate is valid from 2017-01-30, 7:00 PM to 2018-02-01, 6:59 PM] X.509, CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US [certificate is valid from 2013-12-09, 7:00 PM to 2023-12-09, 6:59 PM] X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US (verisignclass3g5ca [jdk]) [trusted certificate] >>> TSA X.509, CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US [certificate is valid from 2012-10-17, 8:00 PM to 2020-12-29, 6:59 PM] X.509, CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US [certificate is valid from 2012-12-20, 7:00 PM to 2020-12-30, 6:59 PM] 825 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.SF 7475 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.RSA 0 Tue Sep 12 20:07:54 EDT 2017 META-INF/ 0 Tue Sep 12 20:07:16 EDT 2017 components/ 0 Tue Sep 12 20:07:16 EDT 2017 components/images/ smk 523 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo$1.class [entry was signed on 2017-09-12, 4:08 PM] >>> Signer X.509, CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US [certificate is valid from 2017-01-30, 7:00 PM to 2018-02-01, 6:59 PM] X.509, CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US [certificate is valid from 2013-12-09, 7:00 PM to 2023-12-09, 6:59 PM] X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US (verisignclass3g5ca [jdk]) [trusted certificate] >>> TSA X.509, CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US [certificate is valid from 2012-10-17, 8:00 PM to 2020-12-29, 6:59 PM] X.509, CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US [certificate is valid from 2012-12-20, 7:00 PM to 2020-12-30, 6:59 PM] smk 3440 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.class ... smk 2346 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.jnlp ... smk 172 Tue Sep 12 20:07:16 EDT 2017 components/images/left.gif ... smk 235 Tue Sep 12 20:07:16 EDT 2017 components/images/middle.gif ... smk 172 Tue Sep 12 20:07:16 EDT 2017 components/images/right.gif ... s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore - Signed by "CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US" Digest algorithm: SHA-256 Signature algorithm: SHA256withRSA, 2048-bit key Timestamped by "CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US" on Tue Sep 12 20:08:49 UTC 2017 Timestamp digest algorithm: SHA-1 Timestamp signature algorithm: SHA1withRSA, 2048-bit key jar verified. The signer certificate expired on 2018-02-01. However, the JAR will be valid until the timestamp expires on 2020-12-29. X.509 (distinguished name) . . PGP bob PGP, (bob) . JDK 17 2021 JARSIGNER(1)