JARSIGNER(1) JDK JARSIGNER(1) (NAME) jarsigner - (JAR) OpenJDK 25 (SYNOPSIS) jarsigner [] jar-file alias jarsigner -verify [] jar-file [alias ...] jarsigner -version . JARSIGNER . -verify -verify (keystore alias) JAR . -verify jarsigner JAR . -keystore . -strict jarsigner "jar verified, with signer errors" . jar-file JAR . -strict jarsigner "jar signed, with signer errors" . alias -keystore . -version -version jarsigner . (DESCRIPTION) jarsigner : o (JAR). o JAR . JAR . jar JAR . ( ZIP JAR jar jarsigner JAR META-INF/MANIFEST.MF .) ( ) ( ) . : o . o . o . o . . jarsigner (keystore) JAR . X.509 . keytool . jarsigner . JAR . jarsigner JAR JAR ( ) . jarsigner (timestamps) . ( ) JAR . jarsigner ( ) . jarsigner JAR jar ZIP . . (KEYSTORE ALIASES) . jarsigner JAR . working JAR bundle.jar : jarsigner bundle.jar working jarsigner . (KEYSTORE LOCATION) jarsigner -keystore URL . .keystore user.home . URL KeyStore.load . NONE URL . (KEYSTORE IMPLEMENTATION) KeyStore java.security . . : keytool jarsigner. PKCS12 RSA PKCS12 Personal Information Exchange Syntax Standard . jarsigner . PKCS#11 -keystore NONE -storetype PKCS11 jarsigner . -storetype . jarsigner keystore.type java.security . jarsigner KeychainStore macOS . . (SUPPORTED ALGORITHMS) jarsigner JAR : keyalg key size default sigalg block file extension ------------------------------------------------------------------------- DSA SHA256withDSA .DSA RSA < 624 SHA256withRSA .RSA <= 7680 SHA384withRSA > 7680 SHA512withRSA EC < 512 SHA384withECDSA .EC >= 512 SHA512withECDSA RSASSA-PSS < 624 RSASSA-PSS (with .RSA SHA-256) <= 7680 RSASSA-PSS (with SHA-384) > 7680 RSASSA-PSS (with SHA-512) EdDSA 255 Ed25519 .EC 448 Ed448 o RSASSA-PSS jarsigner . jarsigner . RSASSA-PSS RSASSA-PSS SHA-384 MGF1 . o JAR .DSA . -sigalg . jarsigner jdk.jar.disabledAlgorithms jdk.security.legacyAlgorithms . JAR JAR . JAR (legacy) . -J-Djava.security.debug=jar . jdk.jar.disabledAlgorithms jdk.security.legacyAlgorithms java.security ( $JAVA_HOME/conf/security JDK) . : JDK . JDK -sigalg . JAR (THE SIGNED JAR FILE) jarsigner JAR JAR META-INF : o .SF o .DSA .RSA .EC -sigfile . -sigfile . . (SIGNATURE FILE) (.SF) JAR . . . . -sectionsonly . . (SIGNATURE BLOCK FILE) jarsigner . PKCS#7 . (SIGNATURE TIME STAMP) jarsigner (signature timestamp) JAR . jarsigner JAR . (Time Stamping Authority TSA) -tsa -tsacert . . JAR (JAR FILE VERIFICATION) JAR JAR . JAR : o .SF . o .SF . o JAR. . . JAR (MULTIPLE SIGNATURES FOR A JAR FILE) JAR . jarsigner JAR . .SF META-INF . JARSIGNER (OPTIONS FOR JARSIGNER) jarsigner . : o (-) . o . o () ( ) . o -storepass -keypass -sigfile -sigalg -digestalg -signedjar TSA JAR JAR . -keystore JAR . JAR . -keystore url URL . .keystore user.home . . . -verbose JAR . -keystore URL URL file: : o -keystore filePathAndName o -keystore file:filePathAndName Sun PKCS #11 java.security ( $JAVA_HOME/conf/security JDK) keytool jarsigner PKCS #11 : -keystore NONE -storetype PKCS11 PKCS#11 : keytool -keystore NONE -storetype PKCS11 -list -storepass [:env | :file] argument . ( ) JAR . -storepass . env file argument . : o env: argument. o file: argument. : . -storetype storetype . keystore.type getDefaultType java.security.KeyStore . PIN PKCS #11 -storepass . keytool jarsigner PIN . ( PIN ) -protected . -keypass [:env | :file] argument -certchain file . jarsigner JAR . . env file argument . : o env: argument. o file: argument. : . -certchain file . . X.509 PKCS#7 (Base64) Internet RFC 1421 Certificate Encoding Standard [http://tools.ietf.org/html/rfc1421]. -sigfile file .SF . DUKESIGN .SF DUKESIGN.SF DUKESIGN.RSA META-INF JAR . a-zA-Z0-9_- . . .SF . -sigfile .SF . . (_) . -signedjar file JAR . -digestalg algorithm JAR . Java Security Standard Algorithm Names . SHA-384 . -addprovider -providerClass . -sigalg algorithm JAR . JAR . . -addprovider -providerClass . Java Security Standard Algorithm Names . -verify JAR . -verbose[:suboptions] -verbose jarsigner (verbose) . jarsigner JAR . suboptions all grouped summary . -certs ( all) JAR . -certs -verbose:grouped . -certs -verbose:summary . one entry (and more) . JAR . -certs -certs -verify -verbose JAR . ( ) X.509 ( java.security.cert.X509Certificate) (distinguished name) . . ( ) . . -revCheck JAR . -revCheck jarsigner OCSP (CRL) . . -tsa url -tsa http://example.tsa.url JAR . URL (TSA) URL -tsacert . -tsa TSA . jarsigner (TSP) RFC 3161 TSA . TSA . -tsacert alias -tsacert alias JAR . TSA . Subject Information Access URL TSA . -tsacert TSA . -tsapolicyid policyid (OID) TSA . TSA . X.696 ITU (ITU-T) . 1.2.3.4. -tsadigestalg algorithm (message imprint) TSA . SHA-384 . . Java Security Standard Algorithm Names . -internalsf JAR .SF ( ) . . JAR .SF . -internalsf . . -internalsf . -sectionsonly -sectionsonly .SF ( ) JAR . JAR . . . JAR . . .SF . JAR . -sectionsonly . . -protected true false . PIN true . -providerName providerName java.security -providerName . . Oracle PKCS #11 providerName SunPKCS11-TokenName TokenName . PKCS #11 SmartCard : jarsigner -keystore NONE -storetype PKCS11 -providerName SunPKCS11-SmartCard -list -addprovider name [-providerArg arg] ( SunPKCS11) . . keytool jarsigner -providerArg ConfigFilePath ConfigFilePath . PKCS #11 Oracle PKCS #11 : jarsigner -keystore NONE -storetype PKCS11 -addprovider SunPKCS11 -providerArg /mydir1/mydir2/token.config -providerClass provider-class-name [-providerArg arg] java.security . . : PKCS11 . -addprovider . -providerPath classpath (classpath) -providerClass . . -Jjavaoption javaoption . jarsigner . . . java -h java -X . -strict . . . -conf url . keytool . "jarsigner.all" "jarsigner.sign" "jarsigner.verify" . jarsigner JAR () . -version . (ERRORS AND WARNINGS) jarsigner . jarsigner . -strict jarsigner -strict OR . . KeyUsage jarsigner -strict (=+) . : macOS . jarsigner . (FAILURE) jarsigner ( ) JAR JAR . failure . . (SEVERE WARNINGS) : -strict . jarsigner JAR JAR . hasExpiredCert . JAR . hasExpiredTsaCert . . notYetValidCert . JAR . chainNotValidated . JAR . tsaChainNotValidated . . signerSelfSigned . JAR (self-signed) . disabledAlg . . badKeyUsage . JAR KeyUsage . badExtendedKeyUsage . JAR ExtendedKeyUsage . badNetscapeCertType . JAR NetscapeCertType . hasUnsignedEntry . JAR . notSignedByAlias . JAR () . aliasNotInStore . JAR . tsaChainNotValidated . JAR TSA . (INFORMATIONAL WARNINGS) extraAttributesDetected POSIX / (symlink) JAR . jarsigner . hasExpiringCert JAR . hasExpiringTsaCert YYYY-MM-DD . hasMultipleManifests JAR . . hasNonexistentEntries JAR . internalInconsistenciesDetected JAR JarFile JarInputStream . legacyAlg . noTimestamp JAR . JAR (YYYY-MM-DD) . JAR (EXAMPLE OF SIGNING A JAR FILE) bundle.jar jane mystore working JAR sbundle.jar : jarsigner -keystore /working/mystore -storepass keystore_password -keypass private_key_password -signedjar sbundle.jar bundle.jar jane -sigfile .SF JAR . JANE.SF JANE.RSA . : jarsigner -keystore /working/mystore -signedjar sbundle.jar bundle.jar jane keystore (.keystore ) keystore : jarsigner -signedjar sbundle.jar bundle.jar jane JAR JAR (bundle.jar) -signedjar : jarsigner bundle.jar jane JAR (EXAMPLE OF VERIFYING A SIGNED JAR FILE) JAR JAR : jarsigner -verify ButtonDemo.jar jar verified . . -verbose . jarsigner -verbose : jarsigner -verify -verbose ButtonDemo.jar s 866 Tue Sep 12 20:08:48 EDT 2017 META-INF/MANIFEST.MF 825 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.SF 7475 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.RSA 0 Tue Sep 12 20:07:54 EDT 2017 META-INF/ 0 Tue Sep 12 20:07:16 EDT 2017 components/ 0 Tue Sep 12 20:07:16 EDT 2017 components/images/ sm 523 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo$1.class sm 3440 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.class sm 2346 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.jnlp sm 172 Tue Sep 12 20:07:16 EDT 2017 components/images/left.gif sm 235 Tue Sep 12 20:07:16 EDT 2017 components/images/middle.gif sm 172 Tue Sep 12 20:07:16 EDT 2017 components/images/right.gif s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore - Signed by "CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US" Digest algorithm: SHA-256 Signature algorithm: SHA256withRSA, 2048-bit key Timestamped by "CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US" on Tue Sep 12 20:08:49 UTC 2017 Timestamp digest algorithm: SHA-1 Timestamp signature algorithm: SHA1withRSA, 2048-bit key jar verified. The signer certificate expired on 2018-02-01. However, the JAR will be valid until the timestamp expires on 2020-12-29. (EXAMPLE OF VERIFICATION WITH CERTIFICATE INFORMATION) -certs -verify -verbose JAR . ( X.509 ) JAR : jarsigner -keystore $JAVA_HOME/lib/security/cacerts -verify -verbose -certs ButtonDemo.jar s k 866 Tue Sep 12 20:08:48 EDT 2017 META-INF/MANIFEST.MF >>> Signer X.509, CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US [certificate is valid from 2017-01-30, 7:00 PM to 2018-02-01, 6:59 PM] X.509, CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US [certificate is valid from 2013-12-09, 7:00 PM to 2023-12-09, 6:59 PM] X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US (verisignclass3g5ca [jdk]) [trusted certificate] >>> TSA X.509, CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US [certificate is valid from 2012-10-17, 8:00 PM to 2020-12-29, 6:59 PM] X.509, CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US [certificate is valid from 2012-12-20, 7:00 PM to 2020-12-30, 6:59 PM] 825 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.SF 7475 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.RSA 0 Tue Sep 12 20:07:54 EDT 2017 META-INF/ 0 Tue Sep 12 20:07:16 EDT 2017 components/ 0 Tue Sep 12 20:07:16 EDT 2017 components/images/ smk 523 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo$1.class [entry was signed on 2017-09-12, 4:08 PM] >>> Signer X.509, CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US [certificate is valid from 2017-01-30, 7:00 PM to 2018-02-01, 6:59 PM] X.509, CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US [certificate is valid from 2013-12-09, 7:00 PM to 2023-12-09, 6:59 PM] X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US (verisignclass3g5ca [jdk]) [trusted certificate] >>> TSA X.509, CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US [certificate is valid from 2012-10-17, 8:00 PM to 2020-12-29, 6:59 PM] X.509, CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US [certificate is valid from 2012-12-20, 7:00 PM to 2020-12-30, 6:59 PM] smk 3440 Tue Sep 12 20:08:48 EDT 2017 components/ButtonDemo.class ... smk 2346 Tue Sep 12 20:08:48 EDT 2017 components/ButtonDemo.jnlp ... smk 172 Tue Sep 12 20:08:48 EDT 2017 components/images/left.gif ... smk 235 Tue Sep 12 20:08:48 EDT 2017 components/images/middle.gif ... smk 172 Tue Sep 12 20:08:48 EDT 2017 components/images/right.gif ... s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore - Signed by "CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US" Digest algorithm: SHA-256 Signature algorithm: SHA256withRSA, 2048-bit key Timestamped by "CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US" on Tue Sep 12 20:08:49 UTC 2017 Timestamp digest algorithm: SHA-1 Timestamp signature algorithm: SHA1withRSA, 2048-bit key jar verified. The signer certificate expired on 2018-02-01. However, the JAR will be valid until the timestamp expires on 2020-12-29. X.509 . . PGP bob PGP, (bob) . JDK 25.0.4.1 2026 JARSIGNER(1)