JARSIGNER(1) JDK Commands JARSIGNER(1) (NAME) jarsigner - (JAR) (SYNOPSIS) jarsigner [options] jar-file alias jarsigner -verify [options] jar-file [alias ...] jarsigner -version options . Options for jarsigner . -verify -verify (alias) keystore JAR . -verify jarsigner JAR keystore . keystore -keystore keystore . -strict jarsigner "jar verified, with signer errors" . jar-file JAR . -strict jarsigner "jar signed, with signer errors" . alias keystore -keystore keystore . -version -version jarsigner . (DESCRIPTION) jarsigner : o (JAR). o JAR. JAR . jar JAR . ( ZIP JAR jar jarsigner JAR META-INF/MANIFEST.MF .) ( ) ( ) . : o . o . o . o . . / . . jarsigner keystore JAR . keystore X.509 . keytool keystore . jarsigner . JAR keystore . jarsigner JAR ( ) . jarsigner (timestamp) JAR . (API) . jarsigner JAR jar zip . JAR zip META-INF/MANIFEST.MF . jarsigner zip META-INF/MANIFEST.MF . jarsigner JAR zip . JAR -verify . jarsigner . -revCheck . . -strict . Errors and Warnings ..SH " (KEYSTORE ALIASES)" (keystore) (alias) . jarsigner JAR keystore . JAR JAR . (store password) . . keystore . (KEYSTORE LOCATION) jarsigner -keystore URL . keystore .keystore user.home . macOS: user.home . -keystore KeyStore.load . NONE URL (null stream) KeyStore.load . KeyStore NONE . (KEYSTORE IMPLEMENTATION) KeyStore java.security keystore . (concrete) keystore . keystore (keytool jarsigner). keystore PKCS12 . keystore RSA PKCS12 Personal Information Exchange Syntax . . Oracle . keystore () JKS . keystore ( ) . keystore (provider-based) KeyStore Service Provider Interface (SPI) . KeystoreSpi java.security package Service Provider Interface . (provider) Java Security API . keystore provider KeystoreSpi How to Implement a Provider in the Java Cryptography Architecture [https://www.oracle.com/pls/topic/lookup?ctx=en/java/javase&id=security_guide_implement_provider_jca] . keystore getInstance KeyStore . keystore keystore keystore keystore . keystore . jarsigner keystore URL . MSCAPI Windows PKCS11 . jarsigner keytool -storetype keystore . keystore keystore keystore.type . java.security JDK java.home/conf/security . keystore.type keystore . keystore . KeyStore getDefaultType keystore.type . keystore keystore.type : KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); keystore pkcs12 RSA PKCS12 Personal Information Exchange Syntax . : keystore.type=pkcs12 keystore . JKS jks . keystore keystore . keystore jks Oracle : keystore.type=jks jarsigner JAR : keyalg sigalg -------------------------------------------------------------------------------------- DSA SHA256withDSA .DSA RSA < 624 SHA256withRSA .RSA <= 7680 SHA384withRSA > 7680 SHA512withRSA EC < 512 SHA384withECDSA .EC >= 512 SHA512withECDSA RSASSA-PSS[1] < 624 RSASSA-PSS ( .RSA SHA-256) <= 7680 RSASSA-PSS ( SHA-384) > 7680 RSASSA-PSS ( SHA-512) EdDSA[2] EdDSA .EC ML-DSA[2] ML-DSA .DSA 1. RSASSA-PSS jarsigner . jarsigner . 3072 RSASSA-PSS RSASSA-PSS SHA-384 MGF1 . 2. EdDSA ML-DSA . . ( Ed25519 Ed448 EdDSA) . .DSA . -sigalg . jarsigner jdk.jar.disabledAlgorithms jdk.security.legacyAlgorithms . JAR JAR . JAR (legacy) . -J-Djava.security.debug=jar . jdk.jar.disabledAlgorithms jdk.security.legacyAlgorithms java.security ( $JAVA_HOME/conf/security JDK) . : (out of the box) JDK . JDK -sigalg ..SH " JAR (THE SIGNED JAR FILE)" jarsigner JAR JAR JAR META-INF : o .SF o .DSA .RSA .EC -sigfile . -sigfile MKSIGN MKSIGN.SF MKSIGN.RSA . RSA . -sigfile .SF (alias) . . (_) . . (SIGNATURE FILE) ( .SF) jarsigner JAR . JAR .SF : o o (SHA) o SHA : (SHA) SHA . SHA () . .SF . (header) . . . JAR (JAR File Verification) . (SIGNATURE BLOCK FILE) .SF . keystore . .DSA .RSA .EC . Supported Algorithms . (SIGNATURE TIME STAMP) jarsigner JAR (timestamp) : o -tsa url o -tsacert alias o -tsapolicyid policyid o -tsadigestalg algorithm Options for jarsigner . JAR (JAR FILE VERIFICATION) JAR JAR . JAR : 1. .SF. ( ) . (.SF) .SF . 2. .SF . .SF . . . .SF . (SIGNATURE FILE) . .SF . ( jar) JAR .SF . JAR ( jarsigner ) .SF .SF . JAR . .SF . 3. JAR .SF . . . (security exception) . jarsigner . 4. . Supported Algorithms . : ( -strict ) ( -verbose -certs) ..SH " JAR (MULTIPLE SIGNATURES FOR A JAR FILE)" JAR jarsigner (alias) : jarsigner myBundle.jar susan jarsigner myBundle.jar kevin JAR .SF JAR . JAR : SUSAN.SF SUSAN.RSA KEVIN.SF KEVIN.RSA JARSIGNER (OPTIONS FOR JARSIGNER) jarsigner . : o (-) . o . o () ( ) . o -storepass -keypass -sigfile -sigalg -digestalg -signedjar TSA JAR JAR . -keystore JAR . JAR . -keystore url (URL) keystore . .keystore user.home . keystore . keystore keystore . keystore keystore -verbose JAR keystore . -keystore URL URL file: : o -keystore filePathAndName o -keystore file:filePathAndName Sun PKCS #11 java.security ( $JAVA_HOME/conf/security JDK) keytool jarsigner PKCS #11 : -keystore NONE -storetype PKCS11 PKCS#11 : keytool -keystore NONE -storetype PKCS11 -list -storepass [:env | :file] argument keystore . ( ) JAR . -storepass . env file argument . : o env: argument . o file: argument . : . -storetype storetype keystore . keystore keystore.type getDefaultType java.security.KeyStore . (PIN) PKCS #11 -storepass . keytool jarsigner . ( PIN ) -protected . -keypass [:env | :file] argument -certchain file keystore . jarsigner JAR . keystore . env file argument . : o env: argument . o file: argument . : . -certchain file keystore ( ) . keystore . X.509 PKCS#7 ( Base64 ) Internet RFC 1421 Certificate Encoding Standard [http://tools.ietf.org/html/rfc1421] . -sigfile file .SF . file DUKESIGN .SF DUKESIGN.SF DUKESIGN.RSA META-INF JAR . file a-zA-Z0-9_- . . .SF . -sigfile .SF . . (_) . -signedjar file JAR . -digestalg algorithm JAR . Java Security Standard Algorithm Names Specification . SHA-384 . -addprovider -providerClass . -sigalg algorithm JAR . JAR . Supported Algorithms . (provider) -addprovider -providerClass . Java Security Standard Algorithm Names Specification . -verify JAR . -verbose[:suboptions] -verbose jarsigner . jarsigner JAR . (suboptions) all grouped summary . -certs ( all) JAR . -certs -verbose:grouped . -certs -verbose:summary . one entry (and more) . Example of Verifying a Signed JAR File Example of Verification with Certificate Information . -certs -certs -verify -verbose JAR . ( ) X.509 ( java.security.cert.X509Certificate) (distinguished name) . (keystore) . ( ) . (alias) . -revCheck JAR . -revCheck jarsigner OCSP CRL . . -tsa url -tsa http://example.tsa.url JAR (time stamp) . http://example.tsa.url (TSA) -tsacert . -tsa TSA . jarsigner (Time-Stamp Protocol TSP) RFC 3161 TSA . TSA . -tsacert alias -tsacert alias JAR . (alias) TSA . Subject Information Access TSA . -tsacert TSA . -tsapolicyid policyid (OID) TSA . TSA . X.696 ITU ( ITU-T) . 1.2.3.4. -tsadigestalg algorithm (message digest) TSA . SHA-384 . Supported Algorithms . Java Security Standard Algorithm Names Specification . -internalsf JAR .SF ( ) . . JAR .SF . -internalsf . . -internalsf . -sectionsonly -sectionsonly .SF ( ) JAR . JAR . Signature File . . JAR . . .SF . JAR File Verification . -sectionsonly . . -protected true false . PIN true . -providerName providerName java.security -providerName . . Oracle PKCS #11 providerName SunPKCS11-TokenName TokenName . PKCS #11 SmartCard : jarsigner -keystore NONE -storetype PKCS11 -providerName SunPKCS11-SmartCard -list -addprovider name [-providerArg arg] ( SunPKCS11) . . -providerArg ConfigFilePath keytool jarsigner ConfigFilePath . PKCS #11 keystore Oracle PKCS #11 . jarsigner -keystore NONE -storetype PKCS11 -addprovider SunPKCS11 -providerArg /mydir1/mydir2/token.config -providerClass provider-class-name [-providerArg arg] (master class) java.security . (fully-qualified class name) . : PKCS11 . -addprovider . -providerPath classpath classpath -providerClass . . -Jjavaoption javaoption Java . jarsigner (wrapper) . . . java -h java -X . -strict . . (ERRORS AND WARNINGS) . -conf url . keytool . : "jarsigner.all" "jarsigner.sign" "jarsigner.verify" . jarsigner JAR () (alias) . -version . (ERRORS AND WARNINGS) jarsigner . jarsigner . -strict jarsigner -strict OR . . KeyUsage -strict jarsigner (=+) . : Linux macOS . jarsigner ..SH " (FAILURE)" jarsigner JAR JAR ( ). failure 1. . (SEVERE WARNINGS) : -strict . jarsigner JAR JAR . hasExpiredCert 4. JAR . hasExpiredTsaCert 4. . notYetValidCert 4. JAR . chainNotValidated 4. JAR . tsaChainNotValidated 64. . signerSelfSigned 4. JAR (self-signed) . disabledAlg 4. . badKeyUsage 8. JAR KeyUsage . badExtendedKeyUsage 8. JAR ExtendedKeyUsage . badNetscapeCertType 8. JAR NetscapeCertType . hasUnsignedEntry 16. JAR . notSignedByAlias 32. JAR () (alias) . aliasNotInStore 32. JAR (alias) keystore . tsaChainNotValidated 64. JAR TSA ..SH " (INFORMATIONAL WARNINGS)" . . extraAttributesDetected POSIX / (symlink) JAR . jarsigner . hasExpiringCert JAR . hasExpiringTsaCert YYYY-MM-DD . hasMultipleManifests JAR . . hasNonexistentEntries JAR . internalInconsistenciesDetected JAR JarFile JarInputStream . legacyAlg . noTimestamp JAR . (YYYY-MM-DD) JAR . JAR (EXAMPLE OF SIGNING A JAR FILE) bundle.jar (alias) jane (keystore) mystore working JAR sbundle.jar : jarsigner -keystore /working/mystore -storepass keystore_password -keypass private_key_password -signedjar sbundle.jar bundle.jar jane -sigfile .SF JAR . JANE.SF JANE.RSA . ( ) : jarsigner -keystore /working/mystore -signedjar sbundle.jar bundle.jar jane keystore (.keystore ) keystore : jarsigner -signedjar sbundle.jar bundle.jar jane JAR JAR (bundle.jar) -signedjar : jarsigner bundle.jar jane JAR JAR : jarsigner -verify ButtonDemo.jar jar verified . . -verbose . jarsigner -verbose : jarsigner -verify -verbose ButtonDemo.jar s 866 Tue Sep 12 20:08:48 EDT 2017 META-INF/MANIFEST.MF 825 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.SF 7475 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.RSA 0 Tue Sep 12 20:07:54 EDT 2017 META-INF/ 0 Tue Sep 12 20:07:16 EDT 2017 components/ 0 Tue Sep 12 20:07:16 EDT 2017 components/images/ sm 523 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo$1.class sm 3440 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.class sm 2346 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.jnlp sm 172 Tue Sep 12 20:07:16 EDT 2017 components/images/left.gif sm 235 Tue Sep 12 20:07:16 EDT 2017 components/images/middle.gif sm 172 Tue Sep 12 20:07:16 EDT 2017 components/images/right.gif s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore - Signed by "CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US" Digest algorithm: SHA-256 Signature algorithm: SHA256withRSA, 2048-bit key Timestamped by "CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US" on Tue Sep 12 20:08:49 UTC 2017 Timestamp digest algorithm: SHA-1 Timestamp signature algorithm: SHA1withRSA, 2048-bit key jar verified. The signer certificate expired on 2018-02-01. However, the JAR will be valid until the timestamp expires on 2020-12-29. (EXAMPLE OF VERIFICATION WITH CERTIFICATE INFORMATION) -certs -verify -verbose JAR . (distinguished name) ( X.509 ) (alias) keystore ( JAR keystore ) : jarsigner -keystore $JAVA_HOME/lib/security/cacerts -verify -verbose -certs ButtonDemo.jar s k 866 Tue Sep 12 20:08:48 EDT 2017 META-INF/MANIFEST.MF >>> Signer X.509, CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US [certificate is valid from 2017-01-30, 7:00 PM to 2018-02-01, 6:59 PM] X.509, CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US [certificate is valid from 2013-12-09, 7:00 PM to 2023-12-09, 6:59 PM] X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US (verisignclass3g5ca [jdk]) [trusted certificate] >>> TSA X.509, CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US [certificate is valid from 2012-10-17, 8:00 PM to 2020-12-29, 6:59 PM] X.509, CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US [certificate is valid from 2012-12-20, 7:00 PM to 2020-12-30, 6:59 PM] 825 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.SF 7475 Tue Sep 12 20:08:48 EDT 2017 META-INF/ORACLE_C.RSA 0 Tue Sep 12 20:07:54 EDT 2017 META-INF/ 0 Tue Sep 12 20:07:16 EDT 2017 components/ 0 Tue Sep 12 20:07:16 EDT 2017 components/images/ smk 523 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo$1.class [entry was signed on 2017-09-12, 4:08 PM] >>> Signer X.509, CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US [certificate is valid from 2017-01-30, 7:00 PM to 2018-02-01, 6:59 PM] X.509, CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US [certificate is valid from 2013-12-09, 7:00 PM to 2023-12-09, 6:59 PM] X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US (verisignclass3g5ca [jdk]) [trusted certificate] >>> TSA X.509, CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US [certificate is valid from 2012-10-17, 8:00 PM to 2020-12-29, 6:59 PM] X.509, CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US [certificate is valid from 2012-12-20, 7:00 PM to 2020-12-30, 6:59 PM] smk 3440 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.class ... smk 2346 Tue Sep 12 20:07:16 EDT 2017 components/ButtonDemo.jnlp ... smk 172 Tue Sep 12 20:07:16 EDT 2017 components/images/left.gif ... smk 235 Tue Sep 12 20:07:16 EDT 2017 components/images/middle.gif ... smk 172 Tue Sep 12 20:07:16 EDT 2017 components/images/right.gif ... s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore - Signed by "CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, ST=California, C=US" Digest algorithm: SHA-256 Signature algorithm: SHA256withRSA, 2048-bit key Timestamped by "CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US" on Tue Sep 12 20:08:49 UTC 2017 Timestamp digest algorithm: SHA-1 Timestamp signature algorithm: SHA1withRSA, 2048-bit key jar verified. The signer certificate expired on 2018-02-01. However, the JAR will be valid until the timestamp expires on 2020-12-29. X.509 (distinguished name) . . PGP bob PGP, (bob) . JDK 26.0.2.1 2026 JARSIGNER(1)