Sign Your First Artifact

Sign a Java JAR file using Infisical-managed keys in about 10 minutes. You’ll issue a code signing certificate, create a signer, and sign your first artifact.

Prerequisites

Product Admin permissions (to create CAs, policies, and profiles)
Java JDK 9+ (for jarsigner)
A JAR file to sign

Steps

Issue a Code Signing Certificate

First, issue a certificate for code signing. Go to Certificate Manager → Certificate Policies and click Create.

Field	Value
Preset	Code Signing Certificate
Name	`code-signing`

Then create a profile and issue a certificate following the same flow as the Issue Certificate quick start, but using the code-signing policy.Download the certificate. You’ll need it for the signer.

Create a Signer

Go to Code Signing → Signers and click Create.

Field	Value
Name	`my-signer`
Certificate	Select the code signing certificate you just issued

Learn more about Signers →

Install PKCS#11 Module

Install the PKCS#11 module for your platform. This enables standard signing tools to use Infisical signers.Create a PKCS#11 config file (pkcs11.cfg):

name = Infisical
library = /path/to/infisical-pkcs11.so

Sign with jarsigner

Run jarsigner with the PKCS#11 provider:

jarsigner -keystore NONE -storetype PKCS11 \
  -providerClass sun.security.pkcs11.SunPKCS11 \
  -providerArg pkcs11.cfg \
  your-app.jar "my-signer"

Result

Your JAR file is now signed with your Infisical-managed key. Verify the signature:

jarsigner -verify -verbose your-app.jar

You should see jar verified with details about the signing certificate.

Next Steps

Add an approval policy for sign-off workflows
Learn how signing access is requested and revoked
See the full jarsigner guide for advanced options

Issue Certificate Certificate Lifecycle

Certificate Management

Product Reference

Reference

Sign Your First Artifact

Prerequisites

Steps

Result

Next Steps

​Prerequisites

​Steps

​Result

​Next Steps

Prerequisites

Steps

Result

Next Steps