net.jsign

Enum KeyStoreType

java.lang.Object

java.lang.Enum<KeyStoreType>

net.jsign.KeyStoreType

All Implemented Interfaces:

Serializable, Comparable<KeyStoreType>

public enum KeyStoreType
extends Enum<KeyStoreType>

Type of a keystore.

Since:

5.0

Enum Constant Summary

Enum Constants

Enum Constant and Description
AWS AWS Key Management Service (KMS).
AZUREKEYVAULT Azure Key Vault.
CRYPTOCERTUM CryptoCertum card.
DIGICERTONE DigiCert ONE.
ESIGNER SSL.com eSigner.
ETOKEN SafeNet eToken This keystore requires the installation of the SafeNet Authentication Client.
GARASIGN
GOOGLECLOUD Google Cloud KMS.
HASHICORPVAULT HashiCorp Vault secrets engine (Transit or GCPKMS).
JCEKS JCE keystore
JKS Java keystore
NITROKEY Nitrokey HSM.
NONE Not a keystore, a private key file and a certificate file are provided separately and assembled into an in-memory keystore
OPENPGP OpenPGP card.
OPENSC OpenSC supported smart card.
ORACLECLOUD Oracle Cloud Infrastructure Key Management Service.
PIV PIV card.
PKCS11 PKCS#11 hardware token.
PKCS12 PKCS#12 keystore
SIGNPATH SignPath.
SIGNSERVER Keyfactor SignServer.
TRUSTEDSIGNING Azure Trusted Signing Service.
YUBIKEY YubiKey PIV.

Method Summary

Modifier and Type	Method and Description
static KeyStoreType	valueOf(String name) Returns the enum constant of this type with the specified name.
static KeyStoreType[]	values() Returns an array containing the constants of this enum type, in the order they are declared.

Methods inherited from class java.lang.Enum

compareTo, equals, getDeclaringClass, hashCode, name, ordinal, toString, valueOf

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Enum Constant Detail

AWS

public static final KeyStoreType AWS

AWS Key Management Service (KMS). AWS KMS stores only the private key, the certificate must be provided separately. The keystore parameter references the AWS region.

The AWS access key, secret key, and optionally the session token, are concatenated and used as the storepass parameter; if the latter is not provided, Jsign attempts to fetch the credentials from the environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN), from the ECS container credentials endpoint, or from the IMDSv2 service when running on an AWS EC2 instance.

In any case, the credentials must allow the following actions: kms:ListKeys, kms:DescribeKey and kms:Sign.

AZUREKEYVAULT

public static final KeyStoreType AZUREKEYVAULT

Azure Key Vault. The keystore parameter specifies the name of the key vault, either the short name (e.g. myvault), or the full URL (e.g. https://myvault.vault.azure.net). The Azure API access token is used as the keystore password.

CRYPTOCERTUM

public static final KeyStoreType CRYPTOCERTUM

CryptoCertum card. No PKCS#11 module is required, Jsign communicates directly with the card and uses the keys and certificates stored in the common file (the secure profile containing eIDAS certificates is not supported).

DIGICERTONE

public static final KeyStoreType DIGICERTONE

DigiCert ONE. Certificates and keys stored in the DigiCert ONE Secure Software Manager can be used directly without installing the DigiCert client tools. The API key, the PKCS#12 keystore holding the client certificate and its password are combined to form the storepass parameter: <api-key>|<keystore>|<password>.

ESIGNER

public static final KeyStoreType ESIGNER

SSL.com eSigner. The SSL.com username and password are used as the keystore password (<username>|<password>), and the base64 encoded TOTP secret is used as the key password.

ETOKEN

public static final KeyStoreType ETOKEN

SafeNet eToken This keystore requires the installation of the SafeNet Authentication Client.

GARASIGN

public static final KeyStoreType GARASIGN

GOOGLECLOUD

public static final KeyStoreType GOOGLECLOUD

Google Cloud KMS. Google Cloud KMS stores only the private key, the certificate must be provided separately. The keystore parameter references the path of the keyring. The alias can specify either the full path of the key, or only the short name. If the version is omitted the most recent one will be picked automatically.

HASHICORPVAULT

public static final KeyStoreType HASHICORPVAULT

HashiCorp Vault secrets engine (Transit or GCPKMS). The certificate must be provided separately. The keystore parameter references the URL of the HashiCorp Vault secrets engine (https://vault.example.com/v1/gcpkms). The alias parameter specifies the name of the key in Vault. For the Google Cloud KMS secrets engine, the version of the Google Cloud key is appended to the key name, separated by a colon character. (mykey:1).

JCEKS

public static final KeyStoreType JCEKS

JCE keystore

JKS

public static final KeyStoreType JKS

Java keystore

NITROKEY

public static final KeyStoreType NITROKEY

Nitrokey HSM. This keystore requires the installation of OpenSC. Other Nitrokeys based on the OpenPGP card standard are also supported with this storetype, but an X.509 certificate must be imported into the Nitrokey (using the gnupg writecert command). Keys without certificates are ignored. Otherwise the OPENPGP type should be used.

NONE

public static final KeyStoreType NONE

Not a keystore, a private key file and a certificate file are provided separately and assembled into an in-memory keystore

OPENPGP

public static final KeyStoreType OPENPGP

OpenPGP card. OpenPGP cards contain up to 3 keys, one for signing, one for encryption, and one for authentication. All of them can be used for code signing (except encryption keys based on an elliptic curve). The alias to select the key is either, SIGNATURE, ENCRYPTION or AUTHENTICATION. This keystore can be used with a Nitrokey (non-HSM models) or a Yubikey. If multiple devices are connected, the keystore parameter can be used to specify the name of the one to use. This keystore type doesn't require any external library to be installed.

OPENSC

public static final KeyStoreType OPENSC

OpenSC supported smart card. This keystore requires the installation of OpenSC. If multiple devices are connected, the keystore parameter can be used to specify the name of the one to use.

ORACLECLOUD

public static final KeyStoreType ORACLECLOUD

Oracle Cloud Infrastructure Key Management Service. This keystore requires the configuration file or the environment variables used by the OCI CLI. The storepass parameter specifies the path to the configuration file (~/.oci/config by default). If the configuration file contains multiple profiles, the name of the non-default profile to use is appended to the storepass (for example ~/.oci/config|PROFILE). The keypass parameter may be used to specify the passphrase of the key file used for signing the requests to the OCI API if it isn't set in the configuration file.

The certificate must be provided separately using the certfile parameter. The alias specifies the OCID of the key.

PIV

public static final KeyStoreType PIV

PIV card. PIV cards contain up to 24 private keys and certificates. The alias to select the key is either, AUTHENTICATION, SIGNATURE, KEY_MANAGEMENT, CARD_AUTHENTICATION, or RETIRED<1-20>. Slot numbers are also accepted (for example 9c for the digital signature key). If multiple devices are connected, the keystore parameter can be used to specify the name of the one to use. This keystore type doesn't require any external library to be installed.

PKCS11

public static final KeyStoreType PKCS11

PKCS#11 hardware token. The keystore parameter specifies either the name of the provider defined in jre/lib/security/java.security or the path to the SunPKCS11 configuration file.

PKCS12

public static final KeyStoreType PKCS12

PKCS#12 keystore

SIGNPATH

public static final KeyStoreType SIGNPATH

SignPath. The keystore parameter specifies the organization, and the storepass parameter the API access token. The alias parameter is the concatenation of the project slug and the signing policy slug, separated by a slash character (e.g. myproject/mypolicy).

SIGNSERVER

public static final KeyStoreType SIGNSERVER

Keyfactor SignServer. This keystore requires a Plain Signer worker, preferably configured to allow client-side hashing (with the properties CLIENTSIDEHASHING or ALLOW_CLIENTSIDEHASHING_OVERRIDE set to true), and the SIGNATUREALGORITHM property set to NONEwithRSA or NONEwithECDSA. The worker may be configured with server-side hashing (i.e. with CLIENTSIDEHASHING and ALLOW_CLIENTSIDEHASHING_OVERRIDE set to false, and a proper SIGNATUREALGORITHM set), in this case the worker name or id in the alias has to be suffixed with |serverside.

If necessary the authentication is performed by specifying the username/password or the TLS client certificate in the storepass parameter. If the TLS client certificate is stored in a password protected keystore, the password is specified in the keypass parameter. The keystore parameter references the URL of the SignServer REST API. The alias parameter specifies the id or the name of the worker.

TRUSTEDSIGNING

public static final KeyStoreType TRUSTEDSIGNING

Azure Trusted Signing Service. The keystore parameter specifies the API endpoint (for example weu.codesigning.azure.net). The Azure API access token is used as the keystore password, it can be obtained using the Azure CLI with:

  az account get-access-token --resource https://codesigning.azure.net

YUBIKEY

public static final KeyStoreType YUBIKEY

YubiKey PIV. This keystore requires the ykcs11 library from the Yubico PIV Tool to be installed at the default location. On Windows, the path to the library must be specified in the PATH environment variable.

Method Detail

valueOf

public static KeyStoreType valueOf(String name)

Returns the enum constant of this type with the specified name. The string must match exactly an identifier used to declare an enum constant in this type. (Extraneous whitespace characters are not permitted.)

Parameters:

name - the name of the enum constant to be returned.

Returns:

the enum constant with the specified name

Throws:

IllegalArgumentException - if this enum type has no constant with the specified name

NullPointerException - if the argument is null

values

public static KeyStoreType[] values()

Returns an array containing the constants of this enum type, in the order they are declared. This method may be used to iterate over the constants as follows:

for (KeyStoreType c : KeyStoreType.values())
    System.out.println(c);

Returns:

an array containing the constants of this enum type, in the order they are declared