Code signing with Certum and SimplySign

What follows are my own personal notes relating to the purchase, installation and use of Code signing with Certum and SimplySign.

Sensitive or personal information has been removed from this post.

1 Purchase certificate and verify details (details not included here)

2 Install SimplySign software on mobile and desktop (details not included here)

3 Install certificate TODO - UPDATE: Not actually required with SimplySign (I don't think)

4 Follow steps below:



###############

PRE SIGNING ACTIVITY

BUILD APPLICATION WITH SELF SIGNED CERTIFICATE IN NETBEANS
* Firstly, try building unsigned!!!

###############


1 CREATE eToken.cfg file in same folder as jar file.

CONTENTS OF eToken.cfg file

name=Crypto3PKCS
library="//usr//local//lib//libSimplySignPKCS.dylib"
slot=-1


2 VERIFY eToken.cfg

keytool -v -list -keystore NONE -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerArg eToken.cfg


3 CREATE bundle.pem (contents below)*****
(first MY certificate and second the Certum certificate [Certum Code Signing CA SHA2])
AND copy bundle.pem file to jar folder.

4 SIGN jar (ALTERNATIVELY SEE SCRIPT BELOW *1)

jarsigner -keystore NONE -certchain "bundle.pem" -tsa "http://time.certum.pl" -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg "eToken.cfg" -storepass "removed" "application.jar" "serialNumberRemoved"

NOTE: Last entry in the above is serial number of the certificate AND must be in UPPER CASE.


5 VERIFY jar (OPTIONAL)

jarsigner -verify -verbose -certs -keystore NONE -tsa "http://time.certum.pl" -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg "eToken.cfg" -storepass "removed" "application.jar" "serialNumberRemoved"


6 UPLOAD NEW JAR FILE
NO NEED TO UPLOAD JNLP FILES OR LIB FOLDER (the latter needs to be further verified)
If lib files (jars) are signed by a different certificate, then sign them also and see here for alternative options.


*****

-----BEGIN CERTIFICATE-----
removed
removed
removed
removed
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
removed
removed
removed
removed
-----END CERTIFICATE-----

---

Note: serialNumber is from image below;

*1

See here for a script to automate or at least simplify the signing and verification of jar files.

https://gist.github.com/plisken1/7861b93a3f01f79ae4d728ae101fb460