Java17/21下用jarsigner+Azure Key Vault签Jar遇AZUREKEYVAULT未找到错误

问题详情 #

我在Java 17/21环境下，尝试用jarsigner结合Azure Key Vault证书签名Jar包，执行命令后触发错误：
jarsigner error: java.lang.RuntimeException: unable to instantiate keystore class: AZUREKEYVAULT not found

执行的命令 #

jarsigner -keystore NONE -storetype AzureKeyVault \
          -sigalg SHA512withRSA \
          -signedjar /root/signed.jar /root/naveen.jar "jarsign" \
          -storepass '12345' \
          -providerPath /root/azure-security-keyvault-jca-2.8.1.jar \
          -providerName AzureKeyVault \
          -providerClass com.azure.security.keyvault.jca.KeyVaultJcaProvider \
          -J--module-path="/root/azure-security-keyvault-jca-2.8.1.jar" \
          -J--add-modules="com.azure.security.keyvault.jca" \
          -J-Dazure.keyvault.uri=https://abc.vault.azure.net  \
          -J-Dazure.keyvault.tenant-id=xxxxx \
          -J-Dazure.keyvault.client-id=Jxxxxx \
          -J-Dazure.keyvault.client-secret=xxxx \
          -debug 

详细错误日志 #

Command line args: [-keystore, NONE, -storetype, AzureKeyVault, -sigalg, SHA512withRSA, -signedjar, /root/signed.jar, /root/naveen.jar, jarsign, -storepass, 12345, -providerPath, /root/ttt.jar, -providerName, AzureKeyVault, -providerClass, com.azure.security.keyvault.jca.KeyVaultJcaProvider, -debug]
loadProviderByClass: com.azure.security.keyvault.jca.KeyVaultJcaProvider
May 03, 2024 11:33:21 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient <init>
INFO: Using Azure Key Vault: https://filesigning-jar-poc.vault.azure.net
May 03, 2024 11:33:21 PM com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil getAccessToken
INFO: Getting access token using client ID / client secret
May 03, 2024 11:33:21 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient <init>
INFO: Using Azure Key Vault: https://filesigning-jar-poc.vault.azure.net
May 03, 2024 11:33:21 PM com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil getAccessToken
INFO: Getting access token using client ID / client secret
May 03, 2024 11:33:21 PM com.azure.security.keyvault.jca.implementation.KeyVaultClient <init>
INFO: Using Azure Key Vault: https://filesigning-jar-poc.vault.azure.net
May 03, 2024 11:33:21 PM com.azure.security.keyvault.jca.implementation.utils.AccessTokenUtil getAccessToken
INFO: Getting access token using client ID / client secret
jarsigner error: java.lang.RuntimeException: unable to instantiate keystore class: AZUREKEYVAULT not found
java.lang.RuntimeException: unable to instantiate keystore class: AZUREKEYVAULT not found
        at jdk.jartool/sun.security.tools.jarsigner.Main.loadKeyStore(Main.java:2295)
        at jdk.jartool/sun.security.tools.jarsigner.Main.run(Main.java:303)
        at jdk.jartool/sun.security.tools.jarsigner.Main.main(Main.java:138)

解决方案 #

• 统一密钥库类型的大小写：JCA Provider注册的密钥库类型为全大写AZUREKEYVAULT，将命令中的-storetype AzureKeyVault改为-storetype AZUREKEYVAULT。
• 校验Provider路径的准确性：错误日志显示实际加载的是/root/ttt.jar，但命令中指定的是azure-security-keyvault-jca-2.8.1.jar，确认文件路径和文件名完全匹配，避免路径错误导致Provider加载异常。
• 处理模块化依赖（Java 17+）：移除-J--module-path和-J--add-modules参数，改用-providerPath指定所有依赖Jar包（多个Jar用冒号分隔），因为jarsigner在处理模块化Provider时可能存在路径识别问题。
• 调整参数顺序：将Provider相关参数（-providerPath、-providerClass）提前到命令最前面，确保jarsigner优先加载Provider再处理密钥库类型。

修正后的命令示例 #

jarsigner -providerPath /root/azure-security-keyvault-jca-2.8.1.jar:/root/azure-core.jar:/root/azure-identity.jar \
          -providerClass com.azure.security.keyvault.jca.KeyVaultJcaProvider \
          -keystore NONE \
          -storetype AZUREKEYVAULT \
          -sigalg SHA512withRSA \
          -signedjar /root/signed.jar /root/naveen.jar "jarsign" \
          -storepass '12345' \
          -J-Dazure.keyvault.uri=https://abc.vault.azure.net  \
          -J-Dazure.keyvault.tenant-id=xxxxx \
          -J-Dazure.keyvault.client-id=Jxxxxx \
          -J-Dazure.keyvault.client-secret=xxxx \
          -debug

内容的提问来源于stack exchange，提问作者Naveen Kumar