# Signing with pfx **URL:** \ **Category:** Module Development\ **Created:** [July 19, 2019, 1:33pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711 "2019-07-19T13:33:18Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![THK](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@THK](https://forum.inductiveautomation.com/u/THK)\ **Post date:** [July 19, 2019, 1:33pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/1 "2019-07-19T13:33:18Z")
I am using the module signer tool and I cannot get pfx to work. The github readme.md indicates that pfx should work. > Blockquote The path to the keystore containing your code signing certificate. Can be either JKS or PFX format. However i get this error ```auto Exception in thread "main" java.io.IOException: Invalid keystore format at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:664) at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222) at java.base/java.security.KeyStore.load(KeyStore.java:1479) at com.inductiveautomation.ignitionsdk.ModuleSigner$Main.main(ModuleSigner.java:135) ``` I did export my pfx as a jks and it ran but when loaded into ignition it is saying that it is a self signed cert which makes me think something about the jks I exported is not correct. Is there a way to use the pfx format with the module signer (java-11) branch. ---
**Author:** ![THK](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@THK](https://forum.inductiveautomation.com/u/THK)\ **Post date:** [July 19, 2019, 3:04pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/2 "2019-07-19T15:04:07Z")
I dug into this a bit and its a problem with this line ```auto String keyStoreType = keyStoreFile.toPath().endsWith("pfx") ? "pkcs12" : "jks"; ``` ends with is looking for the ending path segment not filename or extension **endsWith** > boolean endsWith(String other) > Tests if this path ends with a Path, constructed by converting the given path string, in exactly the manner specified by the endsWith(Path) method. On UNIX for example, the path "foo/bar" ends with "foo/bar" and "bar". It does not end with "r" or "/bar". Note that trailing separators are not taken into account, and so invoking this method on the Path"foo/bar" with the String "bar/" returns true. ---
**Author:** ![THK](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@THK](https://forum.inductiveautomation.com/u/THK)\ **Post date:** [July 19, 2019, 5:48pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/3 "2019-07-19T17:48:41Z")
@Kevin.Herron tagging you as you are the author in git. I ended up fixing this issue as well as another one being that the default registered security providers do not handle HmacPBESHA256. Let me know if you would like to talk about this. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 21, 2019, 4:13pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/4 "2019-07-21T16:13:18Z")
Thanks I’ll get this fixed up. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 21, 2019, 5:36pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/5 "2019-07-21T17:36:41Z")
I merged the Java 11 branch into master and fixed the bug preventing PFX from being selected. Why did you need to do anything with HmacPBESHA256? ---
**Author:** ![THK](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@THK](https://forum.inductiveautomation.com/u/THK)\ **Post date:** [July 22, 2019, 2:29pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/6 "2019-07-22T14:29:28Z")
@Kevin.Herron I am not an expert in certificates and signing but my keystore required that algorithm. With the default crypto provider I was getting an exception when getting the instance of the keystore. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 22, 2019, 3:15pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/7 "2019-07-22T15:15:32Z")
What software did you use to create your keystore? What JRE are you using? HmacPBESHA256 is not uncommon so I’m surprised the default provider doesn’t support it. ---
**Author:** ![THK](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@THK](https://forum.inductiveautomation.com/u/THK)\ **Post date:** [July 22, 2019, 3:43pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/8 "2019-07-22T15:43:11Z")
The .pfx keystore was created with windows tools. I used the Bouncy Castle provider which resolved the issue. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 22, 2019, 3:45pm UTC](https://forum.inductiveautomation.com/t/signing-with-pfx/26711/9 "2019-07-22T15:45:42Z")
Well, sure enough… Supported in JDK 12: [https://docs.oracle.com/en/java/javase/12/security/oracle-providers.html#GUID-A47B1249-593C-4C38-A0D0-68FA7681E0A7](https://docs.oracle.com/en/java/javase/12/security/oracle-providers.html#GUID-A47B1249-593C-4C38-A0D0-68FA7681E0A7) But not in JDK 11: [https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-A47B1249-593C-4C38-A0D0-68FA7681E0A7](https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-A47B1249-593C-4C38-A0D0-68FA7681E0A7)