Java Code Signing Certificate Tutorial

Java code signing certificates are crucial to secure software development and distribution. They help identify a software program’s source and verify its authenticity, ensuring that end-users can trust the software they are downloading.

In this tutorial, we will guide you through how to install a Java Code Signing Certificate, including creating a Java Keystore, generating a Certificate Signing Request (CSR), and installing the CA-generated code signing certificate file to the Keystore.

How to Install Java Code Signing Certificate?

Before starting, ensure you have the Java Development Kit (JDK) installed on your computer or server. You need it to run the commands needed for this process.

When you make your Certificate Signing Request (CSR), keep track of your keystore file containing your private key. You will need it later to install your Code Signing Certificate.

Using a Windows Server, use the Command Prompt to run the commands. Your JDK bin folder should be included in your PATH environment, like C:\Program Files\Java\jdk1.7.0_02\bin.

Alternatively, you can go to the JDK bin folder and run the keytool command directly from there.

Note: Always remember to move the keystore and CSR files to a different location after creating them.

How to Create a Java Keystore File and CSR?

• First, create a Java Keystore file and a Certificate Signing Request (CSR). This involves using a command in the command prompt and entering information about your organization and your certificate.

keytool -genkey -alias server -keyalg RSA -keysize 4096 -keystore keystore.jks

• In the second step, you will be prompted to enter information, which will then be used to generate a Java Keystore file named keystore.jks

• Enter keystore password:
• Re-enter new password:
• What is your first and last name?
• [Unknown]: Firstname Lastname or YourCompanyName
• What is the name of your organizational unit?
• [Unknown]: YourDepartment
• What is the name of your organization?
• [Unknown]: YourCompanyName or Firstname Lastname
• What is the name of your City or Locality?
• [Unknown]: YourCity
• What is the name of your State or Province?
• [Unknown]: YourState or YourProvince
• What is the two-letter country code for this unit?
• [Unknown]: US
• Is CN=YourCompanyName or Firstname Lastname, OU=YourDepartment, O=YourCompanyName or Firstname Lastname, L=YourCity, ST=YourState, C=US correct?
• [no]: yes
• Enter key password for <server>
• (RETURN if same as keystore password):

• In the command line, you can generate a private key and a CSR file by executing the following command:

keytool -certreq -alias server -file csr.csr -keystore keystore.jks

This command will produce a .jks and .csr file, and it will ask you to enter the password that you created in step 2. The password you enter is used to secure the private key and the .jks file

To order your code signing certificate, open the .csr file in a text editor and copy the contents into the CSR box on the order form. Remember to keep the keystore and its password safe, as you will need them to install your certificate and sign code.

Install your Code Signing Certificate

To install your code signing certificate from DigiCert, use the following steps:

• Open the Command Prompt
• Run the following command:

keytool -import -trustcacerts -alias server -file YourName.p7b -keystore keystore.jks

• You will see a message that says “Certificate reply was installed in keystore.”
• If asked to trust the certificate, type y or yes.

Now, your code signing certificate is installed, and you can start signing your code.

The next question is how to sign Java .jar files with jarsigner. Let’s answer that.

How to Sign Java .jar files with Jarsigner?

Once you have installed your Code Signing certificate in the keystore, you are ready to sign Java .jar files with the jarsigner tool. To sign a .jar file, run the following command in the command prompt:

jarsigner -keystore keystore.jks YourJarFile.jar server

Note: You will be prompted for the keystore password. You will also receive a message stating: “jar signed.” You have now signed your .jar file.