• View
• Edit
• History
• Print

JavaCodeSigningCertificatesForBerkeley

Berkeley now provides code signing certificates, but using them is a little tricky because the certificate ends up in the browser and needs to be backed up as a PKCS12 file and converted to a JKS format keystore that can be read by the jarsigner command. In addition, during the conversion, the keystore alias is changed.

See https://wiki.eecs.berkeley.edu/ptolemy/Ptolemy/Certificates for the current Ptolemy II code signing certificate.

Get the certificate

https://calnetweb.berkeley.edu/calnet-technologists/calnet-incommon-comodo-certificate-service says:

I emailed the above alias and the response was asked if a browser certificate would work and to provide my email address and name that would appear in the certificate. I was told that I would get an invitation to generate a private key and then a second email where I should pick up my signed public key using the same browser.

I responded with my email address and name.

I then received an email message from InCommon telling me to go to a URL and generate a private key. I did that.

I then received an email message from InCommon telling me that my certificate had been created. I went to that URL and my certificate was added to the certificates of my browser.

Export the certificate from Firefox

In Firefox on the Mac, to view the certificate, do Preferences -> Privace & Security -> Security -> View Certificates. The certificate will have a recent date on it and say something like "University of California at Berkeley's Internet 2 id".

In the Certificate Manager window of Firefox, select the certificate and click on Backup and save the file with a .p12 extension. This is a PKCS#12 file format. We use Backup here so that we get the private key and the public key.

This password is also used when adding the cert to the keystore below, so choose a password that can be shared with others if necessary

To view the contents of the backup, use the command below. The password is the password that was entered when the certificate was saved.

If you get

then the password you entered for keytool does not match, see http://bugs.java.com/bugdatabase/view_bug.do?bug_id=6974037

One important thing to note is that the alias for this key is university of california, berkeley (regents of the univ. of ca)’s internet2 id. This alias is used later. To see the alias, use:

The above command will also list the email address that was supplied:

Import the certificate into your keystore

Use the command below to convert the PKCS12 file created by Firefox to a JKS file that can be used by jarsigner.

The key features are

-importkeystore

Import the keystore. This command line option is found in recent versions of keytool such as the version that is shipped with Java 6. See http://docs.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html for details. This parameter is very important and not present in earlier versions of keytool. The Mac OS X 10.7 keytool man page does not mention -importkeystore

-srcalias "university of california, berkeley (regents of the univ. of ca)’s internet2 id"

The alias in the srckeystore. The value of the alias can be found with keytool -v -list -keystore ucb.p12 -storetype PKCS12, look for Alias name.

-srckeystore jnlp-ptolemy-software-cert.p12

The file created by Firefox when the certificate was backed up.

-srcstoretype PKCS12

The type of the source certificate.

-destkeystore ptkeystore.jks

The keystore that will be used by jarsigner.

-destalias ptolemy

A shorter alias that is easier to use in scripts

View the contents of ptkeystore.jks:

Use the certificate

We create a jar file and sign it.

Resigning Jar files

When the certificate expires, we need to resign the jar files.

I Resign! Resigning Jar Files with Initium. by Doug Lyon outlines the solution:

1. Get a new certificate (See above)
2. Load the certificate into our keystore. For Ptolemy, this is /users/ptII/adm/certs/ptKeystore on moog
3. Back up the jar files
4. Unjar the previously signed .jar files
5. Rejar the directories into .jar files of the same name.
6. Sign the .jar files and
7. Verify the .jar file signatures.

Get a new certificate

See above.

Load the certificate into our keystore.

For Ptolemy, this is /users/ptII/adm/certs/ptKeystore on moog.

Back up the jar files

  [root@moog books]# pwd
  /home/www/ptweb/books
  [root@moog books]# tar -zcf Systems23Jan2015.tar.gz Systems

Unjar the previously signed .jar files

A sample script is at http://ptolemy.eecs.berkeley.edu/books/updatejars

1. Rejar the directories into .jar files of the same name.
2. Sign the .jar files and
3. Verify the .jar file signatures.
   1. Verify returns jarsigner: Signature Block missing for PTOLEMY. Solution: use jarsigner from Oracle JVM 1.7 or later: /usr/lib/jvm/latest/bin/jarsigner -verify Systems/models/signed/lib/smackx.jar
   2. Verify returns This jar contains unsigned entries which have not been integrity-checked. The solution is to index the file 'before signing it.