GOOGLECLOUD: Google Cloud KMSHASHICORPVAULT: HashiCorp VaultORACLECLOUD: Oracle Cloud Key Management ServiceSIGNSERVER: Keyfactor SignServerTRUSTEDSIGNING: Azure Trusted SigningSignServer is an on-premises open source signing service developed by Keyfactor.
+SignServer supports various signing operations handled by signer workers. Jsign requires a
+Plain Signer
+worker configured with the CLIENTSIDEHASHING or ALLOW_CLIENTSIDEHASHING_OVERRIDE properties
+set to true, and the SIGNATUREALGORITHM property set to NONEwithRSA or
+NONEwithECDSA.
The authentication is performed by specifying the username/password or the TLS client certificate in the
+storepass parameter. If the TLS client certificate is stored in a password protected keystore, the password
+is specified in the keypass parameter. The keystore parameter references the URL of the
+SignServer REST API. The alias parameter specifies the id or the name of the worker.
Authenticating with a username and a password:
+ ++ jsign --storetype SIGNSERVER \ + --keystore https://example.com/signserver \ + --storepass "<username>|<password>" \ + --alias test \ + application.exe ++ +
Authenticating with a TLS client certificate:
+ ++ jsign --storetype SIGNSERVER \ + --keystore https://example.com/signserver \ + --storepass "/path/to/client-certificate.p12" \ + --keypass <client-certificate-password> \ + --alias test \ + application.exe ++ +
Signing with the Oracle Cloud Infrastructure Key Management Service requires the
diff --git a/jsign-cli/src/main/java/net/jsign/JsignCLI.java b/jsign-cli/src/main/java/net/jsign/JsignCLI.java
index 12969b2f..9cb9c6a5 100644
--- a/jsign-cli/src/main/java/net/jsign/JsignCLI.java
+++ b/jsign-cli/src/main/java/net/jsign/JsignCLI.java
@@ -95,6 +95,7 @@ public static void main(String... args) {
+ "- GOOGLECLOUD: Google Cloud KMS\n"
+ "- HASHICORPVAULT: HashiCorp Vault\n"
+ "- ORACLECLOUD: Oracle Cloud Key Management Service\n"
+ + "- SIGNSERVER: Keyfactor SignServer\n"
+ "- TRUSTEDSIGNING: Azure Trusted Signing\n").build());
options.addOption(Option.builder("a").hasArg().longOpt(PARAM_ALIAS).argName("NAME").desc("The alias of the certificate used for signing in the keystore").build());
options.addOption(Option.builder().hasArg().longOpt(PARAM_KEYPASS).argName("PASSWORD").desc("The password of the private key. When using a keystore, this parameter can be omitted if the keystore shares the same password").build());
diff --git a/jsign-crypto/src/main/java/net/jsign/KeyStoreType.java b/jsign-crypto/src/main/java/net/jsign/KeyStoreType.java
index 29961471..c082b21c 100644
--- a/jsign-crypto/src/main/java/net/jsign/KeyStoreType.java
+++ b/jsign-crypto/src/main/java/net/jsign/KeyStoreType.java
@@ -547,6 +547,16 @@ Provider getProvider(KeyStoreBuilder params) {
}
},
+ /**
+ * Keyfactor SignServer. This keystore requires a Plain Signer worker configured to allow client-side hashing (with
+ * the properties CLIENTSIDEHASHING or ALLOW_CLIENTSIDEHASHING_OVERRIDE set to true), and
+ * the SIGNATUREALGORITHM property set to NONEwithRSA or NONEwithECDSA.
+ *
+ *
The authentication is performed by specifying the username/password or the TLS client certificate in the + * storepass parameter. If the TLS client certificate is stored in a password protected keystore, the password is + * specified in the keypass parameter. The keystore parameter references the URL of the SignServer REST API. The + * alias parameter specifies the id or the name of the worker.
+ */ SIGNSERVER(false, false, false) { @Override void validate(KeyStoreBuilder params) { diff --git a/jsign-maven-plugin/src/main/java/net/jsign/JsignMojo.java b/jsign-maven-plugin/src/main/java/net/jsign/JsignMojo.java index aa7b99ad..c400d0cd 100644 --- a/jsign-maven-plugin/src/main/java/net/jsign/JsignMojo.java +++ b/jsign-maven-plugin/src/main/java/net/jsign/JsignMojo.java @@ -90,7 +90,7 @@ public class JsignMojo extends AbstractMojo { /** * The type of the keystore (JKS, JCEKS, PKCS12, PKCS11, ETOKEN, NITROKEY, OPENPGP, OPENSC, PIV, YUBIKEY, AWS, - * AZUREKEYVAULT, DIGICERTONE, ESIGNER, GARASIGN, GOOGLECLOUD, HASHICORPVAULT, ORACLECLOUD or TRUSTEDSIGNING). + * AZUREKEYVAULT, DIGICERTONE, ESIGNER, GARASIGN, GOOGLECLOUD, HASHICORPVAULT, ORACLECLOUD, SIGNSERVER or TRUSTEDSIGNING). */ @Parameter( property = "jsign.storetype" ) private String storetype; diff --git a/jsign/src/deb/data/usr/share/bash-completion/completions/jsign b/jsign/src/deb/data/usr/share/bash-completion/completions/jsign index cbf4473a..15a0ed2b 100644 --- a/jsign/src/deb/data/usr/share/bash-completion/completions/jsign +++ b/jsign/src/deb/data/usr/share/bash-completion/completions/jsign @@ -42,7 +42,7 @@ _jsign() return 0 ;; --storetype) - COMPREPLY=( $( compgen -W 'JKS JCEKS PKCS12 PKCS11 AWS AZUREKEYVAULT DIGICERTONE ESIGNER ETOKEN GARASIGN GOOGLECLOUD HASHICORPVAULT ORACLECLOUD TRUSTEDSIGNING YUBIKEY NITROKEY OPENPGP OPENSC PIV' -- "$cur" ) ) + COMPREPLY=( $( compgen -W 'JKS JCEKS PKCS12 PKCS11 AWS AZUREKEYVAULT DIGICERTONE ESIGNER ETOKEN GARASIGN GOOGLECLOUD HASHICORPVAULT ORACLECLOUD SIGNSERVER TRUSTEDSIGNING YUBIKEY NITROKEY OPENPGP OPENSC PIV' -- "$cur" ) ) return 0 ;; --storepass|-a|--alias|--keypass|-t|--tsaurl|-r|--tsretries|-w|--tsretrywait|-n|--name|-u|--url|--proxyUrl|--proxyUser|--proxyPass|--value) diff --git a/jsign/src/deb/data/usr/share/man/man1/jsign.1 b/jsign/src/deb/data/usr/share/man/man1/jsign.1 index 7276db52..969df446 100644 --- a/jsign/src/deb/data/usr/share/man/man1/jsign.1 +++ b/jsign/src/deb/data/usr/share/man/man1/jsign.1 @@ -99,6 +99,8 @@ Cloud key management systems: .br - ORACLECLOUD : Oracle Cloud Key Management Service .br +- SIGNSERVER : Keyfactor SignServer +.br - TRUSTEDSIGNING: Azure Trusted Signing This option is not required for file based keystores (JKS, JCEKS and PKCS12).