Convert the Java JKS key-store to Microsoft PFX format

Copyright © 2004, 2005 TJ

The GNU General Public License version 2 or later applies to my ExportPrvKey.class. See http://www.gnu.org/licenses/gpl.html

Here's how to get and use a code-signing Thawte digital certificate to sign your Java JAR and Microsoft CAB, EXE, DLL, VBscript, etc. code, to create trusted applets for downloading over the Internet, and to convert the Java JKS key-store to P12/Microsoft PFX (Personal Information Exchange) format to share the same certificate with Java JAR files and Microsoft CAB files.

This allows software authors to increase the range of activities the Java Security Manager will permit.

Contents

• Overview
• Download and Install Tools
• Personal Freemail account at Thawte
• Request a Free Test Certificate
• Create a New Java Key/Certificate Pair
• Generate a Certificate Signing Request
• Import Thawte Certificate to Sun Java JKS Key-store
• Convert Sun Java JKS Keystore to Microsoft PFX format
• Import Key & Certificate to Microsoft Key-store
• Sign a Java JAR File
• Sign a Microsoft CAB file
• Observations

Sign a Java JAR File

In the DOS command prompt window, change directory to a folder containing a JAR file you want to sign.

Now run the jarsigner.exe tool. The arguments are: jarsigner.exe [options] jarfile.jar alias

Here's an example on my system.

cd \Projects\jsEvents

jarsigner.exe -keystore C:\Projects\CodeSigning\CodeSigning.jks jsEvents.jar CodeSigning

If it has run successfully the JAR file will now be signed, and you can deploy it to a web server.

If you have any comments or simply find this guide a useful time-saver I'd welcome hearing from you. You can email me at codesigning@tjworld.net.

© Copyright 2004, 2005 TJ. You are welcome to link directly to this article and make a non-public personal copy (not redistributed or republished). The article must remain in XHTML form (mustn't be converted to proprietary formats such as PDF or DOC). If you would like to include it in a commercial service (e.g. a subscription or advertiser-supported web site) please ask.