---
title: "Fortanix DSM with Microsoft CNG and Java 8 for JAR Signing"
slug: "fortanix-dsm-with-microsoft-cng-and-java-8-for-jar-signing"
updated: 2026-08-19T15:19:24Z
published: 2026-08-19T15:19:24Z
canonical: "support.fortanix.com/fortanix-dsm-with-microsoft-cng-and-java-8-for-jar-signing"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Microsoft CNG and Java 8 for JAR Signing

## 1.0 Introduction

This article provides an overview of how to sign a Java ARchive (JAR) file using the **Microsoft CNG Client and Java 8 for JAR Signing**.

It also contains the information that a user requires to:

- Generate a private key and import a certificate.
- Verifying the signed JAR file.

## 2.0 Prerequisites

Ensure the following:

- Download the latest Fortanix CNG client from [*here*](/v1/docs/cng-ekm). This will download the `sdkms-jce-provider-bundled-x.xx.xxxx.jar` file on your system.

## 3.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating a Security Object

Perform the following steps to generate an RSA key in the Fortanix DSM:

1. In the DSM left navigation panel, click the**Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-SO(26).png)

**Figure 3: Adding security object**
2. On the**Add new Security Object** page:
  1. **Security Object name**: Enter the name of your security object. For example, **RSA-Key-Demo**.
  2. **Group**: Select the group as created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#33-creating-a-group).
  3. Select**GENERATE**.
  4. In the **Choose a type** section, select the **RSA** key type.
  5. In the **Key Size** section, select the size of the key in bits.
  6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.
3. Click**GENERATE**to create the new security object.

*For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.*

## 4.0 Setup Fortanix Microsoft CNG Client on Windows

Perform the following steps to set up the Fortanix CNG client on a Windows machine:

1. Move the downloaded `sdkms-jce-provider-bundled-x.xx.xxxx.jar` file to the `${JAVA_HOME}/jre/lib/ext` directory.
2. Apply Unlimited Strength Jurisdiction Policy Files by downloading the policy files from the [Java website](https://www.oracle.com/java/technologies/javase-jce8-downloads.html).
3. Extract the content of the downloaded zip file and copy the following files to the `${JAVA_HOME}/jre/lib/security` directory:
  - `local_policy.jar`
  - `US_export_policy.jar`
4. Alternatively, you can add the JCE provider in the `${JAVA_HOME}/jre/lib/security/java.security` file as the **last** provider in the list for non-program-based usage. For example, `keytool`, `jarsigner`, and so on.

The following is a sample `java.security` file:

```bash
security.provider.1=sun.security.provider.Sun 
security.provider.2=sun.security.rsa.SunRsaSign 
security.provider.3=sun.security.ec.SunEC 
security.provider.4=com.sun.net.ssl.internal.ssl.Provider 
security.provider.5=com.sun.crypto.provider.SunJCE 
security.provider.6=sun.security.jgss.SunProvider 
security.provider.7=com.sun.security.sasl.Provider 
security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI 
security.provider.9=sun.security.smartcardio.SunPCSC 
security.provider.10=com.fortanix.sdkms.jce.provider.SdkmsJCE
```

## 5.0 Generate the Certificate Signing Request

Perform the following steps to generate a Certificate Signing Request (CSR) using the private key created in [*Section 3.4: Creating a Security Object*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#34-creating-a-security-object) and using the SignTool:

1. Create a new `inf` file. For example, `request.inf`.
2. Add the following content to the file:

```bash
[NewRequest]
Subject = "CN=<KeyName>"
KeyContainer = "<KeyName for example, RSA-Key-Demo>"
MachineKeySet = true
ProviderName = "Fortanix KMS CNG Provider"
UseExistingKeySet = true
```

Where,
  - `keyContainer`: Refers to the key name as created in [*Section 3.4: Creating a Security Object*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#34-creating-a-security-object).
  - `ProviderName`: Refers to the name of the Fortanix KMS CNG provider.
3. Run the following command to generate the CSR:

```bash
certreq.exe -new request.inf request.csr
```

This command generates a `request.csr` file. You must send this file to a trusted Certificate Authority (CA) to receive a signed certificate.

## 6.0 Import the Signed Certificate into Fortanix DSM

After receiving the signed certificate from the CA, you need to import it into Fortanix DSM.

> [!NOTE]
> NOTE
> 
> The name of the imported certificate must be `&lt;KeyName&gt;-certificate-0`. For example, `RSA-Key-Demo-certificate-0`.

Perform the following steps to import an RSA key in the Fortanix DSM:

1. In the DSM left navigation panel, click the**Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-SO(5).png)

**Figure 4: Importing certificate**
2. On the**Add new Security Object** page:
  1. **Security Object Name**: Enter the name of your security object. For example, **RSA-Key-Demo**.
  2. **Group**: Select the group as created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#33-creating-a-group).
  3. Select**IMPORT**.
  4. In the **Choose a type** section, select the **RSA** key type.
  5. In the **Place value here or import from file** section, select the value format type as **Hex**, **Base64**, or **Raw**,and click **UPLOAD A FILE** to upload the CA signed certificate file generated in [*Section 5.0: Generate the Certificate Signing Request*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#50-generate-the-certificate-signing-request). For example, `&lt;KeyName&gt;-certificate-0`.
  6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.
3. Click**IMPORT** to create the new security object.

*For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.*

## 7.0 Create a Java KeyStore File

This section describes the steps to create a Java KeyStore (`.jks`) file using the certificate imported in the previous section and use it to sign a JAR file.

Perform the following steps:

1. Create a new `.jks` file with the following JSON structure:

```bash
{"<keyName>":{"keyName":"<keyName>","date":1713425597608,"chain":["<keyName-Certificate>"],"certId":null,"isCertEntry":false}}
```

Where,

For example,

```bash
{"RSA-Key-Demo":{"keyName":"RSA-Key-Demo","date":1713425597608,"chain":["RSA-Key-Demo-certificate-0"],"certId":null,"isCertEntry":false}}
```
  - `&lt;keyName&gt;`: Refers to the name of the security object as created in [*Section 3.4: Creating a Security Object*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#34-creating-a-security-object).
  - `&lt;keyName-certificate&gt;`: Refers to the name of the imported certificate.
2. Save the output of the command as `keystore.jks`.
3. Run the following command to sign the JAR file:

```bash
jarsigner -keystore <jks file> -providername sdkms-jce -storetype SDKMS-Local -storepass <group-id> -sigalg SHA256withRSA "sample_signed.jar"  "<keyname alias>"
```

Where,
  - `&lt;jks file&gt;`: Refers to the path to your `.jks` file.
  - `&lt;group-id&gt;`: Refers to the UUID of the group. This is available on the group details page as created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#33-creating-a-group).
  - `&lt;keyname alias&gt;`: Refers to the key name as created in [*Section 3.4: Creating a Security Object*](/v1/docs/using-fortanix-data-security-manager-with-microsoft-cng-and-java-8-for-jar-signing#34-creating-a-security-object).
4. Run the following command to verify the signed JAR file to ensure it has been correctly signed:

```bash
jarsigner -verify "<jarName>" -providerName sdkms-jce -sigalg SHA256withRSA
```

Where, `&lt;jarName&gt;` is the name of the JAR file.