> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign your first artifact

> Sign a JAR file using Infisical Code Signing in under 10 minutes.

Sign a Java JAR file using Infisical-managed keys in about 10 minutes. You'll issue a code signing certificate, create a signer, and sign your first artifact.

## Prerequisites

* Product Admin permissions (to create CAs, policies, and profiles)
* Java JDK 9+ (for jarsigner)
* A JAR file to sign

## Steps

**1. Issue a Code Signing Certificate**

First, issue a certificate for code signing. Go to **Certificate Manager → Certificate Policies** and select **Create**.

| Field | Value |
| - | - |
| Preset | Code Signing Certificate |
| Name | `code-signing` |

Then create a profile and issue a certificate following the same flow as the [Issue Certificate quick start](https://infisical.com/docs/documentation/platform/pki/quick-starts/issue-first-certificate.md), but using the `code-signing` policy.

Download the certificate. You'll need it for the signer.

**2. Create a Signer**

Go to **Code Signing → Signers** and select **Create**.

| Field | Value |
| - | - |
| Name | `my-signer` |
| Certificate | Select the code signing certificate you just issued |

[Learn more about Signers →](https://infisical.com/docs/documentation/platform/pki/code-signing/signers)

**3. Install PKCS#11 Module**

Install the [PKCS#11 module](https://infisical.com/docs/documentation/platform/pki/code-signing/pkcs11-module.md) for your platform. This enables standard signing tools to use Infisical signers.

Create a PKCS#11 config file (`pkcs11.cfg`):

```
name = Infisical
library = /path/to/infisical-pkcs11.so
```

**4. Sign with jarsigner**

Run jarsigner with the PKCS#11 provider:

```bash theme={"dark"}
jarsigner -keystore NONE -storetype PKCS11 \
  -providerClass sun.security.pkcs11.SunPKCS11 \
  -providerArg pkcs11.cfg \
  your-app.jar "my-signer"
```

## Result

Your JAR file is now signed with your Infisical-managed key.

**Verify the signature:**

```bash theme={"dark"}
jarsigner -verify -verbose your-app.jar
```

You should see `jar verified` with details about the signing certificate.

## Next steps

* Add an [approval policy](https://infisical.com/docs/documentation/platform/pki/code-signing/approvals.md) for sign-off workflows
* Learn how [signing access](https://infisical.com/docs/documentation/platform/pki/code-signing/approvals.md#access-lifecycle) is requested and revoked
* See the full [jarsigner guide](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/jarsigner.md) for advanced options


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.