# Module Signing Using Certificate From Certificate Authority

**URL:** <https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366>\
**Category:** Module Development\
**Created:** [October 11, 2023, 9:10pm UTC](https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366 "2023-10-11T21:10:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Karlavage](https://avatars.discourse-cdn.com/v4/letter/d/a9adbd/32.png) [@David\_Karlavage](https://forum.inductiveautomation.com/u/David_Karlavage)\
**Post date:** [October 11, 2023, 9:10pm UTC](https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366/1 "2023-10-11T21:10:12Z")

</div>

Has anyone successfully used a certificate from a CA to sign a module?

I have acquired a Certificate from Digicert ONE and attempting to use DigiCert Keylocker to get the private key. I am using openssl and jarsigner to actually sign the module.

I have also attempted to use the signer-master tool ([GitHub - inductiveautomation/module-signer: A utility that signs modules for use in Ignition](https://github.com/inductiveautomation/module-signer)) in conjunction with my acquired certificate to sign my module. However, I don't have access to the private key which is preventing the module from being signed.

I am pretty much at a loss. What options/ tools are recommended/ available for signing a module using a certificate that was created in a PKI environment where private keys are not accessible?

For further context, I was able to self-sign the module no problem, but I assume that was because I was the one who created the certificate as well as the private key.

---

<div class="post-metadata">

**Author:** ![Greg\_Giles](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/greg_giles/32/52935_2.png) [@Greg\_Giles](https://forum.inductiveautomation.com/u/Greg_Giles)\
**Post date:** [October 11, 2023, 9:21pm UTC](https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366/2 "2023-10-11T21:21:47Z")

</div>

> [@David\_Karlavage](#):
>
> I have acquired a Certificate from Digicert ONE and attempting to use DigiCert Keylocker to get the private key. I am using openssl and jarsigner to actually sign the module.

For clarity, we are able to use the provided key with PKCS11 mappings in openssl and jarsigner tools. However, the configurations don't seem to map to the module-signer tooling.

For example, we could sign an individual JAR file succesfully with

```auto
jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg "pkcs11properties.cfg" -digestalg SHA-256 -signedjar "web-1.0.0.jar" "web-1.0.0.jar" key_514152874 -tsa http://timestamp.digicert.com -tsadigestalg SHA-256

```

However, it appears that ignition is just taking a signature of each file, and including that in the module and not signing the jars. So we attempted to use `openssl` to generate hashes like:

```auto
openssl dgst -engine pkcs11 -keyform engine -sha256 -sign "pkcs11:object=key_514152874;type=private" common-1.0.0.jar | base64 -w 0

```

Using the output from the above to manually write to the `signatures.properties` file, the module fails to load (figured this as a manual process longshot)

Note, the certificates.p7b file included in the module is able to successfully verify the files based upon the hash present ...

Thanks in advanced!

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [October 11, 2023, 9:30pm UTC](https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366/3 "2023-10-11T21:30:22Z")

</div>

Use the module-signer utility IA provides. (maven/github). It can perform PKCS11 module signing from the command line. (I do it all the time shelled from my ant builds.) Confirmed to work with my YubiKey and NitroKey devices. (Not yet incorporated in the gradle plug-in. Use the command line in the interim.)

Not sure how PKCS11 works with Digicert, but they should be providing the information needed to populate a pkcs11.cfg file.

You can also study how the module signer works, if you need to re-implement in a unique environment.

FWIW, a snippet from my ant `build.xml`:

```auto
<java fork="true" jar="${basedir}/../module-signer/target/module-signer-1.0.0-SNAPSHOT-jar-with-dependencies.jar">
	<arg value="-pkcs11-cfg=${basedir}/pkcs11.cfg"/>
	<arg value="-alias=Certificate for PIV Authentication"/>
	<arg value="-keystore-pwd=${keystorepw}"/>
	<arg value="-alias-pwd=${keystorepw}"/>
	<arg value="-chain=${basedir}/autopros-code-signer.p7b"/>
	<arg value="-module-in=${basedir}/Build/modules/${module.name}-${asbuiltversion}-unsigned.modl"/>
	<arg value="-module-out=${basedir}/Build/modules/${module.name}-${asbuiltversion}-v81.modl"/>
</java>

```

and the corresponding `pkcs11.cfg`:

```auto
name = OpenSC
library = /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
description = OpenSC PKCS11 Provider

```

In the above invocation `${keystorepw}` is the device's PIN.

---

<div class="post-metadata">

**Author:** ![David\_Karlavage](https://avatars.discourse-cdn.com/v4/letter/d/a9adbd/32.png) [@David\_Karlavage](https://forum.inductiveautomation.com/u/David_Karlavage)\
**Post date:** [October 11, 2023, 10:00pm UTC](https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366/4 "2023-10-11T22:00:01Z")

</div>

Thanks for the quick response!

There were multiple issues in a couple different places that was causing all the headache.

Anyway, I successfully signed the module using the IA tool and installed it on my trial gateway. The module still appears as "self-signed", is this expected behavior? The namespace was changed to reflect the name given to Digicert when we applied for the certificate so I know that it is at least using the correct certificate .

Also for anyone else looking to do something similar, it wasn't obvious (at least to me) that there even was a `-pkcs` option in the IA signing tool.

The end result looked something like this:

```auto
java -jar module-signer.jar \ 
	-alias=<key_alias>\
	-chain=<pathToMyp7b> \
        -pkcs11-cfg=<path_to_pkcs.cfg> \
	-module-in=<path-to-my-module>/my-unsigned-module.modl \
	-module-out=<path-to-my-module>/my-signed-module.modl

```

where the `-pkcs` parameter replaced the parameters related to the keystore

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [October 11, 2023, 10:08pm UTC](https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366/5 "2023-10-11T22:08:47Z")

</div>

> [@David\_Karlavage](#):
>
> appears as "self-signed", is this expected behavior?

This happens if:

- The CA for the cert isn't well-known to java, or

- The chain file wasn't complete, or

- The chain file wasn't in order (surprisingly common to find reversed).

Ignition doesn't care, by the way. I switched to my own CA last year because many CAs are making it difficult to use local CSRs. (Vendor lock-in. grumble...grumble...)

---

<div class="post-metadata">

**Author:** ![David\_Karlavage](https://avatars.discourse-cdn.com/v4/letter/d/a9adbd/32.png) [@David\_Karlavage](https://forum.inductiveautomation.com/u/David_Karlavage)\
**Post date:** [October 11, 2023, 10:28pm UTC](https://forum.inductiveautomation.com/t/module-signing-using-certificate-from-certificate-authority/80366/6 "2023-10-11T22:28:48Z")

</div>

> [@pturmel](#):
>
> The chain file wasn't complete, or

Just to close the loop on this, my p7b file was built using only one of the three certificates provided by DigiCert. After rebuilding the p7b with all included certificates and re-deploying to ignition everything works as expected.

Thanks again, Phil !!