jarsigner -verify works in Java 6 but not Java 7
jarsigner, java, keytool
Solution
Months later I happened to figure out the answer to my own question. For anyone else with the same issue, here is what I did:
Convert your existing private key and the CA signed cert into a pkcs12 format (this is required since Java's keytool doesn't allow the direct importation of these items). This can be accomplished in a single openssl command:
openssl pkcs12 -export -name signing -in signing.cert -inkey myPrivateKey.key -out keystore.p12
Where signing is the name of my pkcs12 keystore, signing.cert is my CA supplied signed cert, and (obviously) myPrivateKey.key is my private key that was used to sign the Cert Request.
Import this newly created keystore into a Java keystore:
keytool -importkeystore -destkeystore keystore -srckeystore keystore.p12 -srcstoretype pkcs12 -alias signing
Import your CA's Java cert into the keystore. I'm not exactly sure what magic this does but without it the cert chain isn't followed (even when manually adding intermediate certs). This cert is usually provided via the email where your signing cert arrived in. For our purposes it's called signing.pkcs7.
keytool -importcert -file signing.pkcs7 -keystore keystore -v -alias signing
You'll have to enter the keystore password you used when creating the Java keystore.
Use the maven-jarsigner-plugin (or whatever automation is required) to sign your projects during build.
Problem
I've been banging my head against this for a few days and am completely stumped. Here's the rundown: - I've got an Eclipse plugin project using Tycho to build via Maven 3 - Within Maven I've got the maven-jarsigner-plugin set up to sign jars using my keystore (see below for keystore details) - I've got a code signing cert that's been signed by Thawte in my keystore I can take any signed jar file from target/* and run 'jarsigner -verify' on it. This is what happens: ``` #java 6 on a VM vagrant@test2:/vagrant/com.example.plugins.eclipse/target$ jarsigner -verify com.example.eclipse-0.1.3-SNAPSHOT.jar jar verified. ``` Next: ``` #java 7 on a completely different vm vagrant@test1:/vagrant$ jarsigner -verify com.example.eclipse-0.1.3-SNAPSHOT.jar jar verified. Warning: This jar contains entries whose certificate chain is not validated. Re-run with the -verbose and -certs options for more details. ``` I've take care not to use a machine with both Java6 and Java7 installed, so it's not this issue I also don't believe it's algorithm based, as described in this issue, since I can sign the project using either Java 6 or Java 7 and it always verifies in Java6 and never verifies in Java7, regardless of which environment I signed the jars with. Here's the output of keytool -list ``` Keystore type: JKS Keystore provider: SUN Your keystore contains 3 entries root, Aug 11, 2013, trustedCertEntry, Certificate fingerprint (SHA1): 91:C6:D6:EE:3E:8A:C8:63:84:E5:48:C2:99:29:5C:75:6C:81:7B:81 intermediate, Aug 11, 2013, trustedCertEntry, ``` I have to believe that this is a certificate chain issue because I am able to verify the jar using the following command on Java 7: ``` jarsigner -verify -keystore keystore com.example.eclipse-0.1.3-SNAPSHOT.jar ``` Obviously I can't have every user of my plugin using my keystore file, so that's not a solution. It does however, reinforce that I have a cert chain issue in Java 7. Thoughts?