Sign jar files with a Microsoft Authenticode Certificate

Question

Can I use Microsoft Authenticode Certificate for java code signning? Does anyone have experiance with it?

I found this tutorial on the website of thawte, which describes how to convert MS Certificate to Java one. On the other side thawte sells java code signing certificates and I'm not sure if there are some cons converting the MS one.

P.S: I want to sign eclipse plugins with it.

Answer 1

use keytool provided by jdk for generating the certificate, you can sign your jar file with this certificate by using the jarsigner tool. Both keytool, jarsigner are available in bin folder of the jdk1.7.0 kit.

http://docs.oracle.com/javase/tutorial/security/toolsign/rstep2.html

Answer 2

There is typically no difference between a certificate for Authenticode or Java code signing. Both are X.509 certificates with the Extended Key Usage (EKU) "Code Signing".

What could be different is the format of the key store. That is how the private key together with the certificate is stored (if stored in software and not on a smartcard or in a hardware security module). Historically Java was using the Java Keystore format (JKS) but can nowdays use PKCS#12/PFX as well. You should be able to convert the keystore to an appropriate format.