Cannot create signer: No installed provider supports this key: net.jsign.jca.SigningServicePrivateKey

[manishgant]

I am running into the above mentioned error cannot create signer: No installed provider supports this key: net.jsign.jca.SigningServicePrivateKey

What provider do I add to enable support for the SigningServicePrivateKey? I am currently using BouncyCastleProvider and I want to use AWS KMS with jsign to codesign inside a Java App.

[ebourg]

Could you post the code leading to this error?

[manishgant]

I have this in the Bean's initialization

// Using Default AWS credentials obtained from instance
File pemFile = resourceLoader.getResource(pemFilePath);
FileUtils.copyInputStreamToFile(inputStream, pemFile);
Keystore keyStore = new KeyStoreBuilder().storetype(KeyStoreType.AWS).certfile(pemFile).keystore(System.getenv("AWS_REGION")).build();

Later I use this during the signing

fileToBeSigned = new File(context.getOutputfilePath());
AuthenticodeSigner signer = new AuthenticodeSigner(keyStore, "key-alias", "");
signer.withProgramURL("myApp.com")
	  .withTimestamping(true)
	  .withTimestampingAuthority(timestampingUrl);

try (Signable file = Signable.of(fileToBeSigned)) {
		   signer.sign(file);
}

This error comes up after signer.sign(file) is executed. If I debug internally I see the error comes from the line

ContentSigner shaSigner = contentSignerBuilder.build(this.privateKey);

jsign/jsign-core/src/main/java/net/jsign/AuthenticodeSigner.java

Line 413 in 2bdef86

ContentSigner shaSigner = contentSignerBuilder.build(privateKey);

And this is the stacktrace

org.bouncycastle.operator.OperatorCreationException: cannot create signer: No installed provider supports this key: net.jsign.jca.SigningServicePrivateKey
2023-12-06T03:59:30.006529172Z 	at org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.build(Unknown Source)
2023-12-06T03:59:30.007152005Z 	at net.jsign.AuthenticodeSigner.createSignedDataGenerator(AuthenticodeSigner.java:413)
2023-12-06T03:59:30.007174130Z 	at net.jsign.AuthenticodeSigner.createSignedData(AuthenticodeSigner.java:372)
2023-12-06T03:59:30.007264672Z 	at net.jsign.AuthenticodeSigner.sign(AuthenticodeSigner.java:348)
2023-12-06T03:59:30.007272630Z  ......

[ebourg]

The storepass parameter isn't specified, is this running on an EC2 instance?

[manishgant]

Storepass isn't the issue, I am able to reach KMS and obtain what I need from there.

Actually I figured it out, I had to explicitly set the Security provider as SigningServiceJcaProvider. It works now

[ebourg]

You are right, and this isn't properly documented. You should be able to just use the Provider of the KeyStore built instead of creating an instance of SigningServiceJcaProvider, something like this:

Keystore keystore = new KeyStoreBuilder().storetype(AWS).certfile(pemFile).keystore(region).build();
AuthenticodeSigner signer = new AuthenticodeSigner(keystore, "alias", null);
signer.withProgramURL("myApp.com")
      .withSignatureProvider(keystore.getProvider())
      .withTimestamping(true);

[ebourg]

I've modified AuthenticodeSigner in 00f7a25 to automatically set the provider if the keystore is backed by a cloud signing service.