title: Signing a jar with jarsigner using a PFX file
body: <p>What I've done is the following:</p>
  <ol>
  <li>Creating a <code>ca.key</code> and <code>ca.cert</code></li>
  <li>Creating a <code>server.key</code> and <code>server.csr</code></li>
  <li>Signing the CSR with the CA, creating a <code>server.cert</code></li>
  <li>Creating a <code>pfx</code> using the <code>server.cert</code> and <code>server.key</code></li>
  </ol>
  <p>All this using OpenSSL.</p>
  <p>Now I want to sign a JAR file with this PFX file using jarsigner.</p>
  <p><code>$ jarsigner -storetype pkcs12 -keystore certificate.pfx myJAR.jar my-alias</code></p>
  <p>And I get:</p>
  <pre><code>jar signed.
  
  Warning:
  The signer's certificate chain is invalid. Reason: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  No -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2022-05-12) or after any future revocation date.
  
  The signer certificate will expire on 2022-05-12.
  </code></pre>
  <p>I also get this when I verify the jar. I'm guessing that this is due to the fact that nothing tells the JRE to trust the CA that signed the certificate that signed this JAR, but I'm not sure. What is a certificate chain anyway?</p>
  <p>Please help.</p>