Signing .jar file with a .cer file

Question

I'm trying to sign a jar file with a code signing certificate issued by globalsign.

I'm completely new to this but after some googling and a lot of trial and error, I executed the following steps.

I've imported the certificate in my keystore using:

keytool -importcert -alias signalias -file OS200912023195.cer

When I try to sign my jar file using:

jarsigner applet.jar signalias

I get the following error:

jarsigner: Certificate chain not found for: signalias. signalias must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

Did I forget something or lies the problem with the certificate?

Solution 1

...I'm wondering if I maybe need something more than just a cer file?...

@Mark I guess you're right. As I can remember, the exception type like

jarsigner: Certificate chain not found for: signalias. signalias must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

... makes me think you trying to sign jar with cert only. So you must be skipped some important steps :|

The first thing you have to do if you want to use certificate is to gen CSR...

• A) gen keystore; then gen the public/private key in the keystore. Command like a

keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048

• B) then gen CSR - for more information you can read this. Command like a

keytool -certreq -alias mydomain -keystore keystore.jks -file mydomain.csr

• C) for more detailed info about keytool common commands you can read this

if you are OK with OpenSSL then gen your own cert as follows step D...

• D) In the case you need to have a self-signed certificate you can follow these steps...

...back to your keystore

• E) only after then you to import the cert to your keystore with command like

keytool -import -trustcacerts -alias root -file server.crt -keystore keystore.jks

• F) And only then you can use jarsigner tool to sign your jar

---

Comment if that helps

Solution 2

.cer files never store private keys, and to sign a JAR you need to have a private key in your keystore. So I guess, you need to find out where the private key of your certificate is, and add it to your keystore.