SIGNTOOL(1) SIGNTOOL(1) (NAME) signtool - JAR NSS (SYNOPSIS) signtool [[-b basename]] [[-c Compression Level]] [[-d cert-dir]] [[-e extension]] [[-f filename]] [[-i installer script]] [[-h]] [[-H]] [[-v]] [[-w]] [[-G nickname]] [[-J]] [[-j directory]] [-k keyName] [[--keysize | -s size]] [[-l]] [[-L]] [[-M]] [[-m metafile]] [[--norecurse]] [[-O]] [[-o]] [[--outfile]] [[-p password]] [[-t|--token tokenname]] [[-z]] [[-X]] [[-x name]] [[--verbose value]] [[--leavearc]] [[-Z jarfile]] [directory-tree] [archive] (STATUS) . Mozilla NSS bug 836477[1] . (DESCRIPTION) signtool NSS . (JAR) . . JAR . SSL : * * (Netscape Signing Tool) JAR . (Object-signing certificate) . . . . . . . . . . . Netscape Signing Tool 1.3 . : * (CA) . CA . * CA . Netscape . (CA) . Communicator . : CA . CA Communicator . Communicator . Communicator PKCS #12 . (Smart Card) . (OPTIONS) -b basename .rsa .sf META-INF JAR . -b signatures signatures.rsa signatures.sf . signtool . -c# -J -Z . # 0 9 0 9 . . -c# -J -Z 6 . -d certdir key3.db cert7.db . "-d." ( ) . signtool ~/.netscape . NT . -e extension signtool -e".class" . 1.1 . -f commandfile Netscape Signing Tool keyword=value . . << >> . -G nickname - . -d . NT -d -G . -d Communicator . Communicator Communicator . x509.cacert application/x-x509-ca-cert . -G (Self-signed) . 1.0 1024 RSA . -s -t . -i scriptname SmartUpdate . SmartUpdate JAR . -i . -J HTML HTML . . -Z . 6 . -j directory . (Inline) . JAR HTML signtool -v NOT PRESENT . -k key ... directory () . . : signtool -k MyCert -d . signdir. . -k ( -l) . -l . . -k . -L . signtool (*) . --leavearc .arc () -J . . -m metafile (Metadata) . JAR MIME . -M PKCS #11 . --norecurse HTML . -o . . . --outfile outputfile Netscape Signing Tool . -p password . . -s keysize . -G . -t token . -G . -v archive . . --verbosity value . 0 -1 . -w archive . -x directory . . -z signtool . . -Z jarfile JAR . signtool JAR . -J . 6 . (THE COMMAND FILE FORMAT) Netscape Signing Tool keyword=value . = = . . . basename -b. compression -c. certdir -d. extension -e. generate -G. installscript -i. javascriptdir -j. htmldir -J. certname -k -l -k. signdir -k. list -l. = . listall -L. = . metafile -m. modules -M. = . optimize -o. = . password -p. keysize -s. token -t. verify -v. who -w. exclude -x. notime -z. = . jarfile -Z. outfile . . (EXTENDED EXAMPLES) . -L : signtool -L using certificate directory: /u/jsmith/.netscape S Certificates - ------------ BBN Certificate Services CA Root 1 IBM World Registry CA VeriSign Class 1 CA - Individual Subscriber - VeriSign, Inc. GTE CyberTrust Root CA Uptime Group Plc. Class 4 CA * Verisign Object Signing Cert Integrion CA GTE CyberTrust Secure Server CA AT&T Directory Services * test object signing cert Uptime Group Plc. Class 1 CA VeriSign Class 1 Primary CA - ------------ Certificates that can be used to sign objects have *'s to their left. : Verisign Object Signing Cert test object signing cert. -l : signtool -l using certificate directory: /u/jsmith/.netscape Object signing certificates --------------------------------------- Verisign Object Signing Cert Issued by: VeriSign, Inc. - Verisign, Inc. Expires: Tue May 19, 1998 test object signing cert Issued by: test object signing cert (Signtool 1.0 Testing Certificate (960187691)) Expires: Sun May 17, 1998 --------------------------------------- (CA) -L . . . mkdir signdir . . echo boo > signdir/test.f . . signtool -k MySignCert -Z testjar.jar signdir using key "MySignCert" using certificate directory: /u/jsmith/.netscape Generating signdir/META-INF/manifest.mf file.. --> test.f adding signdir/test.f to testjar.jar Generating signtool.sf file.. Enter Password or Pin for "Communicator Certificate DB": adding signdir/META-INF/manifest.mf to testjar.jar adding signdir/META-INF/signtool.sf to testjar.jar adding signdir/META-INF/signtool.rsa to testjar.jar tree "signdir" signed successfully . . signtool -v testjar.jar using certificate directory: /u/jsmith/.netscape archive "testjar.jar" has passed crypto verification. status path ------------ ------------------- verified test.f ZIP Netscape Signing Tool ZIP PATH . -Z zip : cd signdir zip -r ../myjar.jar * adding: META-INF/ (stored 0%) adding: META-INF/manifest.mf (deflated 15%) adding: META-INF/signtool.sf (deflated 28%) adding: META-INF/signtool.rsa (stored 0%) adding: text.txt (stored 0%) -G - . . . : signtool -G MyTestCert using certificate directory: /u/someuser/.netscape Enter certificate information. All fields are optional. Acceptable characters are numbers, letters, spaces, and apostrophes. certificate common name: Test Object Signing Certificate organization: Netscape Communications Corp. organization unit: Server Products Division state or province: California country (must be exactly 2 characters): US username: someuser email address: someuser@netscape.com Enter Password or Pin for "Communicator Certificate DB": [Password will not echo] generated public/private key pair certificate request generated certificate has been signed certificate "MyTestCert" added to database Exported certificate to x509.raw and x509.cacert. (<) : signtool -G MyTestCert inputfile -M -M PKCS #11 : signtool -d "c:\netscape\users\jsmith" -M using certificate directory: c:\netscape\users\username Listing of PKCS11 modules ----------------------------------------------- 1. Netscape Internal PKCS #11 Module (this module is internally loaded) slots: 2 slots attached status: loaded slot: Communicator Internal Cryptographic Services Version 4.0 token: Communicator Generic Crypto Svcs slot: Communicator User Private Key and Certificate Services token: Communicator Certificate DB 2. CryptOS (this is an external module) DLL name: core32 slots: 1 slots attached status: loaded slot: Litronic 210 token: ----------------------------------------------- signtool -k . (Fully Qualified Name) : signtool -k "MyCard:My Signing Cert" directory FIPS -M FIPS-140-1 : signtool -d "c:\netscape\users\jsmith" -M using certificate directory: c:\netscape\users\jsmith Listing of PKCS11 modules ----------------------------------------------- 1. Netscape Internal PKCS #11 Module (this module is internally loaded) slots: 2 slots attached status: loaded slot: Communicator Internal Cryptographic Services Version 4.0 token: Communicator Generic Crypto Svcs slot: Communicator User Private Key and Certificate Services token: Communicator Certificate DB ----------------------------------------------- FIPS-140-1 : signtool -d "c:\netscape\users\jsmith" -M using certificate directory: c:\netscape\users\jsmith Enter Password or Pin for "Communicator Certificate DB": [password will not echo] Listing of PKCS11 modules ----------------------------------------------- 1. Netscape Internal FIPS PKCS #11 Module (this module is internally loaded) slots: 1 slots attached status: loaded slot: Netscape Internal FIPS-140-1 Cryptographic Services token: Communicator Certificate DB ----------------------------------------------- (SEE ALSO) signver (1) NSS . o https://wiki.mozilla.org/NSS_Shared_DB_Howto o https://wiki.mozilla.org/NSS_Shared_DB (ADDITIONAL RESOURCES) NSS ( JSS) NSS : http://www.mozilla.org/projects/security/pki/nss. NSS NSS . : https://lists.mozilla.org/listinfo/dev-tech-crypto (IRC): Freenode #dogtag-pki (AUTHORS) NSS Netscape Red Hat Sun Oracle Mozilla Google . : Elio Maldonado Deon Lackey . (LICENSE) (MPL) 2.0 . MPL http://mozilla.org/MPL/2.0 . (NOTES) 1. Mozilla NSS bug 836477 https://bugzilla.mozilla.org/show_bug.cgi?id=836477 nss SIGNTOOL(1)