[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Code Signing *.jars using DoD PKI Hard token

Posted on 2012-12-28
1
Medium Priority
?
2,146 Views
Last Modified: 2013-01-05
I am at my wits end and will try Experts Exchange for once. Is there any guidance on how to code sign *.jar files using DoD PKI hard card.  The Code Signing certificate is embedded in the card once I get it, however, how do I use the card to sign my *.jar files?
0
Comment
Question by:raychamp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 65

Accepted Solution

by:
btan earned 2000 total points
ID: 38728828
maybe of interest - see "Java Keystore". it uses jarsigner and pfx to sign .jar file. however, CAC (or smart card) is not supposed to have private key exported hence you will not have pfx.  

http://www.ewert-technologies.ca/blog/articles/cross-platform-code-signing

challenge is how to create and link the keystore used for signing to CAC.
there is an old article series (see pg1,2 and 3)  on smart card in general using pkcs#11 which you should take a look first for general smartcard

Pg1-http://www.developer.com/java/other/article.php/3587361/Java-Applet-for-Signing-with-a-Smart-Card.htm
Pg2-http://www.developer.com/java/other/article.php/10936_3587361_2/Java-Applet-for-Signing-with-a-Smart-Card.htm
pg3-http://www.developer.com/java/other/article.php/10936_3587361_3/Java-Applet-for-Signing-with-a-Smart-Card.htm

Specifically the pkcs#11 is using Sun java library seems to be the common way for java. Closest I can find for such java codes (2 links) to CAC are stated below which can be useful ref.

//Create our certificates from our CAC Card
         String configName = "card.config";
         Provider p = new sun.security.pkcs11.SunPKCS11(configName);
         Security.addProvider(p);

http://stackoverflow.com/questions/752890/how-to-connect-to-https-server-using-common-access-card/753129#753129

http://stackoverflow.com/questions/544056/common-access-card-cac-authentication-using-java

You can check this out this section "Signing and Verification with the On-Card Certificate" for the signing as well, but it will be rather similar as above (pg1-3) links

http://rostislav-matl.blogspot.sg/2012/04/using-smart-card-as-keystore-in-java.html

Hope it helps...Personally never done that ....
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How does someone stay on the right and legal side of the hacking world?
Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question