Signing a JAR file using Luna Cloud HSM

name = CloudHSM
library = /usr/safenet/lunaclient/lib/libCryptoki2_64.so
slot = 0

attributes(*,CKO_PRIVATE_KEY,*) = {
  CKA_TOKEN = true
  CKA_SIGN = true
  CKA_SENSITIVE = true
  CKA_PRIVATE = true
  CKA_DECRYPT = true
  CKA_UNWRAP = true
  CKA_EXTRACTABLE = false
  CKA_MODIFIABLE = true
}

attributes(*,CKO_PUBLIC_KEY,*) = {
  CKA_VERIFY = true
  CKA_ENCRYPT = true
  CKA_WRAP = true
  CKA_TOKEN = false
}

attributes(*, CKO_SECRET_KEY,*) = {
 CKA_ENCRYPT = true
 CKA_DECRYPT = true
 CKA_SENSITIVE = true
 CKA_WRAP = true
 CKA_UNWRAP = true
 CKA_PRIVATE = true
 CKA_TOKEN = true
}

Generating keys for signing.

Generating a certificate request using the generated key.

Signing the generated Certificate Signing Request (CSR) using an OpenSSL based Certificate Authority (CA)

Create a P7B File containing the signed certificate and the certificate chain.

Importing certificates from a P7B file to SunPKCS11 keystore.

List contents of the keystore to check it has everything you need.

Check if the JAR file is already signed or not.

Signing the JAR file using the generated signing key.

Verify the signed JAR file.

LunaProvider requires a dummy keystore file containing information about the slot to use.

Generate signing key using LunaProvider

Generate a Certificate Signing Request (CSR).

CSR signed using an OpenSSL based CA.

Create a P7B file containing the signed certificate and the issuers.

Import all certificates from a P7B file.

Signing the jar file using the generated signing key and certificate.

Use this command if you want to load your LunaProvider dynamically.

Verify the signed JAR file.