Token Based JAR Signing - Linux

Dec 18, 2025

Token Based JAR Signing - Linux

Prerequisites

• Import R6-R45 timestamp cross certificate in Linux and Java root CA certificate store to validate the timestamp trust chain.

Guidelines

1. Locate and open terminal as shown below.
   
   
   
   
2. Locate the eToken library file (libeTPkcs11.so) using the terminal command:
   
   find / -name libeTPkcs11.so
   
   Take note of the result as you will need this later. example: /usr/lib64/libeTPkcs11.so
   
   
3. Locate the JarSigner file (JarSigner) using the terminal command: 
   
   find /-name jarsigner
   
   
4. Go to the JarSigner directory we found using this terminal command: 
   
   cd "/JarSigner/Directory"
   
   
5. Open the Linux Terminal Text(Nano) by simply typing the terminal command: nano
   
   
6. In Nano, set up your eToken.cfg file by using the following terminal command:
    

   Name=eToken
   Library=”/usr/lib64/libeTPkcs11.so"

   
7. Save the text file by pressing (Ctrl+O) and name it "eToken.cfg", then press Enter. Note: If prompted to confirm, press Y. Now, press (Ctrl+X) to exit Nano, and return to the Terminal Command Line.
   
      
8. Now confirm that you've created the file in the correct directory. Enter the terminal command: 
   
   dir
   
   Note: This command lists all of the files and folders present in the directory you are currently in. 
   
   
9. Confirm your certificate alias using the terminal command: 
   
   keytool -list -keystore NONE -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerArg eToken.cfg 
   
   Note: Enter your keystore passphrase (token password) when prompted.
   
    
10. Sign the JAR file using the following terminal command: 
    
    jarsigner -keystore NONE -storetype PKCS11 -tsa http://timestamp.globalsign.com/tsa/r45standard -providerClass sun.security.pkcs11.SunPKCS11 -providerArg eToken.cfg /directory/test.jar "certificateAlias" 
    
    Enter your keystore passphrase (token password) when prompted. You'll get a jar signed message once it's completed. 
    
    
11. We can verify the signature now by using the following terminal command: 
     
    jarsigner -verify -verbose /directory/test.jar
    
    You should be getting an output similar to the image below with "jar verified" at the end.