Code Signing *.jars using DoD PKI Hard token

raychamp used Ask the Experts™
I am at my wits end and will try Experts Exchange for once. Is there any guidance on how to code sign *.jar files using DoD PKI hard card.  The Code Signing certificate is embedded in the card once I get it, however, how do I use the card to sign my *.jar files?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Exec Consultant
Distinguished Expert 2018
maybe of interest - see "Java Keystore". it uses jarsigner and pfx to sign .jar file. however, CAC (or smart card) is not supposed to have private key exported hence you will not have pfx.

challenge is how to create and link the keystore used for signing to CAC.
there is an old article series (see pg1,2 and 3)  on smart card in general using pkcs#11 which you should take a look first for general smartcard


Specifically the pkcs#11 is using Sun java library seems to be the common way for java. Closest I can find for such java codes (2 links) to CAC are stated below which can be useful ref.

//Create our certificates from our CAC Card
         String configName = "card.config";
         Provider p = new;

You can check this out this section "Signing and Verification with the On-Card Certificate" for the signing as well, but it will be rather similar as above (pg1-3) links

Hope it helps...Personally never done that ....

btan answers how to use java to sign a document or similar, but I think the actual question is, how to sign a *.jar file (e.g. a Java applet) using a code signing certificate stored on a smartcard.
Maybe this will help:

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial