Java Code Signing Certificate
A Java code signing certificate lets developers sign JAR files and other supported Java software so users and Java based systems can verify the signer and detect changes to signed content.
jarsigner works.Java Code Signing Certificate Providers & Prices
Java signing normally uses a general code signing certificate rather than a separate Java only certificate. The table below puts provider, product, public price and Java signing availability together so the commercial comparison is visible before the technical guide.
Java signing usually uses a general public code signing certificate rather than a certificate sold as a separate Java only product. The commercial question is therefore which provider, validation level and key protection model fit the Java release process.
| Provider | Relevant product | Public starting price | Java / JAR signing | Action |
|---|---|---|---|---|
| DigiCert | Code Signing / EV Code Signing | $696 / $972 | Yes | DigiCert Code Signing options |
| Sectigo | OV / EV Code Signing | From $536.25/year* | Yes | Sectigo Code Signing options |
| SSL.com | IV / OV / EV Code Signing | $129 / $129 / $349 | Yes | SSL.com Code Signing options |
| GlobalSign | Standard / EV Code Signing | $529 / $669 per year | Yes | GlobalSign Code Signing options |
| Certum | Standard / EV Code Signing | Check current price | Yes | Certum Code Signing options |
| HARICA | IV / OV / EV Code Signing | Check current price | Yes | HARICA Code Signing options |
| eMudhra | OV / EV Code Signing | Quote | Yes | eMudhra Code Signing options |
| IdenTrust | TrustID Code Signing / EV | $225 / $281 | Yes | IdenTrust Code Signing options |
| E-Tugra | OV / EV Code Signing | Quote | Yes | E-Tugra Code Signing options |
| Actalis | OV Code Signing | Check current price | Yes | Actalis Code Signing options |
Prices are provider-listed examples and may change by product, term, region and key storage. DigiCert lists $696 for standard code signing and $972 for EV; SSL.com lists $129 for standard code signing and $349 for EV; GlobalSign lists OV from $529/year and EV from $669/year. Sectigo lists code signing from $536.25/year with its five-year purchase option. Confirm the exact Java-compatible product, issuance term and key storage at checkout. Providers without a verified public price are marked “Check current price” or “Quote”.
What Is a Java Code Signing Certificate?
A Java Code Signing Certificate is a publicly trusted certificate used with a private key to create a digital signature for Java software such as JAR files. The certificate connects the public key to a validated publisher identity, while the JAR signature lets a verifier detect changes to signed entries.
The Java signing stack has several parts that are easy to confuse. The certificate is not the keystore, the keystore is not the signature, and jarsigner is not the certificate authority. A practical implementation brings those pieces together: a certificate authority validates the publisher, a protected private key creates the signature, Java tools apply it to the JAR, and verification checks the resulting signature and certificate chain.
Public/private key pair
The private key creates the signature. The public key is used during verification.
X.509 certificate
The certificate associates the public key with the identity validated by the certificate authority.
Java keystore
Java tools use a keystore or supported provider to access the signing key and certificate chain.
JAR signature
The signature protects the signed JAR entries against undetected modification.
Certificate chain
The chain connects the signer certificate to a trusted certification path.
Timestamp
A trusted timestamp records signing time and can matter when the signing certificate later expires.
Does Oracle Issue Java Code Signing Certificates?
Oracle's JCE Code Signing CA is intended for authenticating JCE providers. Oracle states that general Java code signing certificates are available from third party certificate authorities. This distinction is important because a search for a Java Code Signing Certificate can otherwise lead a buyer to the wrong certificate program.
Provides Java and tools such as jarsigner and keytool.
Validates the publisher and issues the public code signing certificate.
Uses the certificate and protected private key to sign the JAR.
Checks the signature, certificate chain and applicable trust information.
What Does Java Code Signing Actually Sign?
The primary artifact in this workflow is the JAR. Oracle's current jarsigner documentation describes signing JAR files and ZIP files, while the JAR specification explains how signature related files are placed under META-INF. The exact trust model can still vary by the Java application, runtime and distribution mechanism, so a generic statement that every Java distribution uses the same signing path would be misleading.
JAR files
The core Java archive format used by many Java applications and libraries.
Java applications
Executable Java application packages can be signed before distribution.
Java libraries
Libraries can be signed when the consuming environment requires signed content.
Plugins
Older plugin based Java deployments may have their own runtime requirements.
Security providers
JCE providers are a specialized signing case with separate Oracle requirements.
ZIP based artifacts
Supported ZIP based content can also be handled by jarsigner.
How Java JAR Signing Works
A JAR signature is more than a certificate pasted onto a file. The signing process creates digest information for JAR entries, records signing information in the JAR's metadata and attaches the cryptographic signature and certificate information. Timestamping can then add evidence about when the signing operation occurred.
Sign the final JAR after build and packaging changes are complete. If a signed entry is changed afterward, the signature can no longer represent the same content.
What Is Inside a Signed JAR?
The signed JAR contains the application or library entries plus metadata used to validate the signature. Looking inside the archive is useful when troubleshooting because it shows whether signing created the expected signature related files.
META-INF/MANIFEST.MF
The manifest contains information used by the JAR packaging and signing process.
.SF signature file
The signature file contains digest information associated with the manifest and signed entries.
.RSA, .DSA or .EC
The signature block contains the cryptographic signature and certificate information for the signer.
Do not treat the presence of these files as proof that the JAR is trusted. Verification still needs to evaluate the signature, certificate chain, algorithm policy and other relevant information.
What Does a Java Signature Prove?
It helps establish
- Signer identity
- Integrity of signed JAR entries
- Certificate chain
- Signing certificate
- Timestamp information when included
It does not establish
- That the application is vulnerability free
- That the code is malware free
- That the software was security audited
- That every dependency is trusted
- That the application is safe in every environment
This distinction matters commercially. A publisher can use a trusted certificate to establish who signed a release and whether signed content changed, but the signature does not replace secure development, dependency review, malware detection or application testing.
Individual vs Organization Java Code Signing
The fact that an application is written in Java does not determine the certificate validation level. The identity you need to present to users and the eligibility requirements of the provider are more important.
Individual
For eligible individual publishers whose certificate identity is tied to a natural person.
Organization
For software companies and organizations that want the legal entity represented in the certificate.
EV
For organizations that meet the provider's extended validation requirements and want the additional validation associated with an EV product.
Choose the certificate around publisher identity and distribution requirements. Do not choose EV merely because the software happens to be Java, and do not assume an individual certificate is interchangeable with an organization certificate when the publisher name matters.
Java Code Signing Certificate Requirements
Issuance starts with certificate authority validation, but the signing environment must also satisfy current key protection requirements. Public code signing rules changed in 2026, reducing maximum validity and strengthening private key protection expectations for newly issued certificates.
The CA verifies the identity represented by the certificate.
The certificate must be appropriate for code signing.
The corresponding private key must be protected and accessible to the approved signing process.
The signer certificate must build to a trusted chain.
Java tools need a supported mechanism to access the key and certificate.
New public code signing certificates are subject to current hardware backed key requirements.
Production JARs should be timestamped so the signing event can be evaluated later.
Java Keystore and Code Signing Certificate
The keystore is the operational bridge between the Java tools and the signing identity. Oracle describes it as a database containing private keys and their associated X.509 certificate chains. The alias identifies the entry that jarsigner uses when creating the signature.
Stores or exposes signing credentials through a supported provider.
Identifies the key and certificate entry used for signing.
Creates the cryptographic signature and must remain protected.
Lets the verifier associate the public key with the validated signer.
JKS vs PKCS12 vs PKCS#11
These terms describe different layers of the Java credential architecture. JKS and PKCS12 are keystore formats, while PKCS#11 is an interface used to communicate with cryptographic hardware or other PKCS#11 providers.
| Type | What it represents | Typical role |
|---|---|---|
| JKS | Traditional Java keystore format | Legacy and Java specific credential storage |
| PKCS12 | Standard interoperable keystore format | Portable software based keystore where permitted |
| PKCS#11 | Cryptographic token or HSM interface | Accessing a protected key without exporting the private key |
For newly issued public code signing certificates, do not assume that a freely exportable PFX or software keystore is an acceptable production model. Confirm the CA's current key storage requirements before designing the Java signing workflow.
How to Get a Java Code Signing Certificate
The commercial lifecycle is straightforward, but the signing environment should be planned before ordering. A certificate that is difficult to access from the intended JDK, token, HSM or signing service can turn a simple purchase into a release engineering problem.
Select certificate type and publisher identity.
Create the key in the approved protected environment.
Complete the CA identity and authorization checks.
Receive the certificate and build the required chain.
Connect the credential to Java tools or signing service.
Apply the signature, timestamp and verify the final JAR.
How to Sign a JAR With jarsigner
jarsigner is the JDK command line tool used to sign and verify JAR files. The command identifies the JAR, the signing alias and the keystore or cryptographic provider that supplies the private key.
jarsigner -keystore keystore.jks application.jar alias
jarsigner -tsa https://timestamp.example.com application.jar alias
Selects the keystore containing the signing credential.
Identifies the artifact being signed.
Selects the certificate and private key entry.
Authenticates access where the chosen keystore requires it.
Requests a timestamp from the specified Time Stamping Authority.
Run verification against the final JAR after signing.
Put the Java signing workflow into practice
Follow the implementation steps for signing a JAR, then timestamp and verify the exact artifact you plan to publish.
How to Verify a Signed JAR
Verification should happen immediately after signing and again against the exact artifact that will be published. Oracle documents jarsigner -verify for checking signed JARs and certificate information.
jarsigner -verify -verbose -certs application.jar
jar verified
Confirms that the signature verification process completed successfully for the checked content.
Signer certificate
Shows the certificate information associated with the signing identity.
Certificate chain
Lets you inspect whether the certificate chain can be validated.
Warnings
Surface trust, algorithm, timestamp or certificate issues that need attention.
Unsigned entries
Identify entries that were not included in the signed content.
Timestamp
Shows timestamp information when the JAR was signed with a TSA.
Java Code Signing With a Hardware Token
A hardware token changes the Java signing architecture because the private key is intended to remain inside the cryptographic device. Java can access the token through a PKCS#11 provider, while jarsigner performs the signing operation through that provider.
Requests the signature.
Connects Java to the token.
Performs the cryptographic operation.
Receives the resulting signature.
Oracle documents PKCS#11 keystores using patterns such as -keystore NONE -storetype PKCS11. GlobalSign also publishes a current Java signing workflow using a security token and PKCS#11.
Java Code Signing With HSM
HSM based signing becomes useful when the signing identity must serve multiple applications, build systems or release teams. Instead of attaching a USB token to one workstation, the signing key can be controlled within a centralized cryptographic boundary and accessed through an approved interface.
Creates or approves the release artifact.
Sends the approved JAR to the signing boundary.
Uses the protected private key to create the signature.
Receives, timestamps, verifies and publishes the JAR.
An HSM architecture also makes access control, audit logging and separation of duties easier to formalize. The exact Java integration depends on the HSM vendor and Java security provider.
Java Code Signing With Cloud Signing
Cloud or remote signing can remove the need to place the production private key on a developer workstation or CI runner. The signing service keeps the key within its protected infrastructure and exposes an approved signing workflow, API or integration.
Cloud signing
Managed infrastructure and protected keys can support distributed development and release teams.
Remote signing
A signing request is sent to a remote service rather than exposing the private key locally.
CI/CD
Automation can request signatures without storing a reusable production key on the build runner.
Java compatibility must be verified provider by provider. A cloud signing service may support JAR signing through a Java provider, HSM integration, PKCS#11 bridge or a custom signing workflow. Do not assume that an API designed for PE files automatically supports jarsigner.
Java Code Signing and CI/CD
For automated Java releases, signing should be a controlled release stage rather than a secret embedded in the build job. The pipeline creates the final JAR, runs tests, requests a signature from the protected signing boundary, timestamps it, verifies it and publishes the verified artifact.
GitHub Actions
Use a protected signing service or supported key integration rather than storing an exportable production private key in repository secrets.
GitLab / Jenkins
Keep production signing separate from ordinary build credentials and restrict signing access to release jobs.
Azure DevOps
Use protected pipeline variables and an approved signing boundary. Verify provider specific Java support before implementation.
Maven / Gradle
Treat signing as part of the release artifact lifecycle rather than ordinary compilation.
HSM
Centralize the key when many applications or teams share the signing identity.
Remote signing
Useful when release teams need controlled signing without local key custody.
Java Code Signing and Maven
Maven can generate the JAR, run tests and prepare a release artifact, but signing should be considered a separate trust boundary. The build lifecycle can produce the artifact first and then invoke the approved signing mechanism during the release stage.
Create classes and resources.
Create the final archive.
Apply the protected Java signing credential.
Verify and distribute the signed artifact.
For Maven Central or a private artifact repository, confirm the repository's own publishing and signature requirements separately. Java code signing and repository artifact signing are related but are not necessarily the same trust mechanism.
Java Code Signing and Gradle
Gradle provides a flexible build model, so Java signing can be placed into a release task after the final JAR has been generated. The important control is that the task receives access to the signing credential only when a production release is being created.
JAR generation
Produce the final artifact before the production signature is applied.
Signing task
Invoke jarsigner or an approved signing integration against the final artifact.
Verification
Verify the output before it enters the release repository or distribution system.
Keep signing credentials outside source control and avoid putting a reusable private key into a developer friendly Gradle configuration file. The same separation used for other CI/CD signing workflows should apply to Gradle based releases.
Timestamping Java JAR Files
Timestamping records when the signing operation occurred through a Time Stamping Authority. This matters because public code signing certificates have limited validity, while software can remain distributed for much longer. A timestamp provides evidence that the signature was created during the certificate's valid period, subject to the applicable validation rules.
The JAR receives the publisher signature.
The TSA records the signing time.
Java can evaluate the timestamp and certificate information.
The timestamp can support validation after certificate expiration when the applicable requirements are satisfied.
Oracle's current jarsigner documentation describes RFC 3161 timestamping through -tsa. GlobalSign's current Java signing guide also recommends timestamping signed code.
Java Code Signing and Certificate Expiration
You should not use an expired certificate for a new production signature.
The timestamp can provide evidence that signing occurred while the certificate was valid, subject to applicable validation and revocation rules.
Revocation is a separate event from ordinary expiration and must be handled through the CA and incident response process.
“Timestamping makes expired certificates valid forever.” That is too broad. Timestamping provides signing time evidence; the final validation result still depends on the certificate chain, revocation information, algorithm rules and verification environment.
Java Signature Algorithms and Hash Algorithms
Algorithm behavior changes across JDK generations. Oracle's current JDK 26 jarsigner documentation states that the default digest algorithm is SHA-384 and that Java security properties determine which algorithms are disabled or treated as legacy. That makes it risky to copy an old JDK 8 signing command into a current production pipeline without testing it.
Digest algorithms
Use current digest algorithms supported by the target JDK and distribution environment. SHA-256 and stronger options may appear in current signing workflows depending on configuration.
RSA and EC
Certificate and key algorithm support should be tested against the JDK versions and signing provider used by the release process.
Disabled algorithms
A signature can fail verification if the JDK security policy disables the algorithm or treats it as legacy.
Java Code Signing Compatibility Across JDK Versions
A signed JAR can be technically valid and still create a compatibility problem when the signing algorithm, key size, certificate chain or timestamp algorithm is handled differently by another JDK generation. Oracle explicitly notes that default key sizes and signature algorithms can change across JDK releases and that interoperability with older versions should be considered.
May accept algorithms or key sizes that newer JDKs treat differently.
May disable older algorithms or classify them as legacy.
Must be included in compatibility testing before a release policy is finalized.
Test the signed artifact on the JDK versions that matter to your users. Do not define compatibility solely from the machine that performed the signing.
What Happens When a JAR Is Modified?
A signed JAR is tied cryptographically to the content that was included in the signing operation. If a signed entry changes, the digest calculated during verification no longer matches the digest represented by the signature.
This is why post signing packaging is dangerous. Adding, replacing or modifying signed entries after the production signature can invalidate the signature. Build, package, sign, timestamp and verify should therefore be treated as an ordered release sequence.
Java Signature Verification Errors
Troubleshooting becomes faster when the error is mapped to the layer that failed. A certificate chain error is different from an unsigned entry, and a disabled algorithm warning is different from a bad alias. Start by running verification with certificate details and capture the exact JDK version and command output.
Inspect the intermediate certificate and trust store used by the verification environment.
Check certificate dates and whether the signature has suitable timestamp evidence.
Check the system clock and certificate validity period.
Inspect the TSA certificate chain and the Java trust configuration.
Confirm that the certificate is appropriate for code signing.
Check the JDK security properties and the signing algorithm used.
Identify required JAR entries that were not included in the signed content.
Check whether the JAR changed after signing.
Confirm that jarsigner is using the intended key and certificate entry.
Check keystore type, provider, password and access to the protected key.
Java and JAR signature troubleshooting covers additional diagnostic steps for common verification failures.
Java Code Signing Provider Comparison
The comparison should be read as a starting point rather than a permanent product catalog. Java support means the provider's general code signing certificate can be used in a Java signing workflow; it does not mean every provider exposes the same keystore, token, HSM or cloud integration.
| Provider | Java / JAR | Individual | Organization | EV | Key infrastructure |
|---|---|---|---|---|---|
| DigiCert | Yes | Product dependent | Yes | Yes | Hardware / KeyLocker |
| Sectigo | Yes | Product dependent | Yes | Yes | FIPS hardware / cloud service options |
| SSL.com | Yes | Yes | Yes | Yes | Hardware / eSigner |
| GlobalSign | Yes | Product dependent | Yes | Yes | Token / HSM |
| Certum | Yes | Yes | Yes | Yes | Token / SimplySign options |
| HARICA | Yes | IV | OV | EV | Hardware |
| eMudhra | Yes | Product dependent | OV | EV | HSM / API dependent |
| IdenTrust | Yes | Product dependent | Yes | Yes | Hardware / HSM |
| E-Tugra | Yes | Product dependent | OV | EV | Provider dependent |
| Actalis | Yes | Product dependent | OV | No EV | Provider dependent |
For exact availability, validation eligibility and signing architecture, the provider's current product documentation should remain the source of truth.
Java Code Signing Certificate Cost
The certificate price is only one part of Java signing cost. A developer signing occasional JARs may have a simple local workflow, while a company publishing hundreds of artifacts can spend more on protected key infrastructure, signing service usage, CI/CD integration and operational controls than on the certificate itself.
Java Code Signing for Software Companies
Software companies often move beyond a single developer workstation because several products, teams or release pipelines need the same signing identity or controlled signing process. Centralized signing can reduce duplicated credentials and make production authorization easier to manage.
Multiple JARs
Sign many release artifacts through a controlled production workflow.
Multiple products
Define which products can use which signing identity and release environment.
Centralized signing
Move the private key into an HSM or managed signing service.
Release approvals
Separate code changes from the authority to create production signatures.
Lifecycle
Track renewal, reissue, expiration and compromise response centrally.
CI/CD
Connect release automation to the protected signing boundary.
Code Signing for Software Companies covers the broader organizational signing model.
Java Code Signing for Independent Developers
An independent developer usually needs fewer controls, but the private key still deserves deliberate protection. The practical workflow is to choose an eligible certificate, configure the Java keystore or hardware token, sign the final JAR, timestamp it and verify it before release.
Choose individual or eligible publisher identity.
Protect the signing key with the supported storage model.
Sign the final artifact with jarsigner.
Check the signature and timestamp before distribution.
Code Signing for Independent Developers covers the broader solo developer workflow.
Java Code Signing for Open Source
Open source projects have a different identity model because maintainers, contributors and automated release systems can all participate in producing artifacts. The signing identity should therefore be separated from ordinary source code permissions and protected against unauthorized release signing.
Maintainer identity
Document who controls the production signing identity.
Release signing
Sign the exact artifact attached to the release.
Protected CI/CD
Avoid exposing the private key as a normal repository secret.
Reproducible builds
Where practical, make it possible to compare the published artifact with the source build.
Verification
Publish enough metadata for users to verify the release signature.
Key response
Document what happens if the maintainer key is lost or compromised.
Code Signing for Open Source Software covers the wider open source signing model.
Java Code Signing Checklist
Certificate
- Correct CA
- Correct publisher identity
- Code Signing EKU
- Current certificate
Key
- Protected private key
- Appropriate keystore
- Hardware or HSM where required
- Access controlled
JAR
- Final artifact built
- Required entries identified
- Signature applied
- Certificate chain included
Timestamp
- RFC 3161 TSA
- Timestamp verified
Verification
jarsigner -verify- Certificate chain validated
- No disabled algorithm warnings
- No unsigned required entries
Release
- Final JAR verified
- Signing identity documented
- Certificate expiry monitored
Java Code Signing Certificate FAQ
What is a Java Code Signing Certificate?
It is a publicly trusted code signing certificate used with a private key to digitally sign Java software such as JAR files.
Does Oracle issue Java Code Signing Certificates?
Oracle's JCE Code Signing CA is for authenticating JCE providers. Oracle states that general Java code signing certificates are available from third party CAs.
What certificate do I need to sign a JAR file?
A compatible public code signing certificate with the appropriate code signing usage and a protected private key can be used with a supported Java signing workflow.
Can I use a DigiCert Code Signing Certificate for Java?
Yes. DigiCert publishes Java specific JAR signing instructions using its code signing certificates and Java signing tools.
Can I use a Sectigo certificate to sign JAR files?
Sectigo states that its code signing certificates support Java and other code signing formats.
Can I use SSL.com for Java code signing?
SSL.com code signing certificates can be used for Java signing when the certificate and selected signing architecture support the required Java workflow.
How much does a Java Code Signing Certificate cost?
Pricing varies by CA, validation level and key storage. Current public examples include IdenTrust at $225 for Code Signing and $281 for EV, GlobalSign from £386 for OV, and HARICA from €59.
How do I sign a JAR file?
Use the JDK's jarsigner with the signing certificate and private key, then timestamp and verify the resulting JAR.
What is jarsigner?
jarsigner is the JDK command line tool used to sign and verify JAR files.
What is keytool?
keytool is a JDK utility used to manage keys, certificates and keystores.
What is a Java keystore?
A Java keystore is a credential database or provider interface used by Java tools to access private keys and certificate chains.
What is the difference between JKS and PKCS12?
JKS is a traditional Java keystore format, while PKCS12 is a standardized interoperable keystore format. PKCS#11 is an interface for cryptographic tokens and HSMs.
Can I store a Java signing key on an HSM?
Yes. Java can interact with HSMs through supported security providers and interfaces such as PKCS#11.
Can jarsigner use a hardware token?
Yes. Oracle documents PKCS#11 keystore support, and providers such as GlobalSign publish token based Java signing procedures.
What is PKCS#11 in Java code signing?
PKCS#11 is an interface that allows Java and other applications to communicate with supported cryptographic hardware without exporting the private key.
Does a JAR signature need a timestamp?
Timestamping is strongly recommended for production signing because it records the signing time and can matter when the signing certificate later expires.
What happens when a Java signing certificate expires?
A new certificate is needed for new signing operations. Existing timestamped signatures may remain verifiable under applicable validation rules.
Why does jarsigner say the certificate chain is not validated?
Common causes include a missing intermediate certificate or a trust store that cannot build the signer chain.
Why does jarsigner report a disabled algorithm?
The JDK security policy may disable or classify the signing or digest algorithm as legacy. Check the JDK version and security properties.
Why does Java say the JAR contains unsigned entries?
Some JAR entries were not included in the signature or were added after signing. Identify the entries and sign the final artifact correctly.
Can Java code signing work in CI/CD?
Yes. The signing stage can use a protected token, HSM, cloud signing service or another supported signing boundary.
Can Maven sign JAR files?
Maven can incorporate signing into a release workflow, but the exact plugin and signing architecture should be chosen for the repository and key protection model.
Can Gradle sign JAR files?
Gradle can run signing as part of a release task. Keep the production signing credential outside source control and verify the final artifact.
Can I sign multiple JAR files with one certificate?
A code signing certificate can be used to sign multiple eligible artifacts during its validity period, subject to the CA's terms and the signing infrastructure.
What is the difference between Java code signing and JCE provider signing?
General Java application signing uses a third party code signing certificate and Java signing tools. Oracle's JCE Code Signing CA is a specialized program for authenticating JCE providers.
Does signing a JAR prove that the Java application is safe?
No. A signature establishes publisher identity and integrity of signed content, but it does not prove that the application is vulnerability free or malware free.
Related Java Code Signing Resources
Choose a Java Code Signing Certificate
Compare the certificate and the signing architecture together
The right Java signing setup is not only a certificate purchase. Match the publisher identity, certificate type, key protection, JDK compatibility, timestamping and release workflow before placing the order.