RSA 證書需要向一個支持RAS的CA公司購買。如Thawte 為了使用RSA證書簽名你的小程序，你需要從Thawte或是其它CA獲得Java代碼簽名證 書。在你登記你的證書的時候可能需要你提供證書簽名請求文件（CSR）你可使用以下 步驟： --------------------------------------------------------- 1。使用keytool建立一個RSA keypair 2. C:>C:jdk1.3inkeytool -genkey -keyalg rsa -alias MyCert 3. Enter keystore passWord: ********* file://鍵入你keystore的密碼 4. What is your first and last name? file://以下是鍵入你的信息 [Unknown]: XXXXXXX YYY 5. What is the name of your organizational unit? 6. [Unknown]: Java Software 7. What is the name of your organization? 8. [Unknown]: Sun Microsystems 9. What is the name of your City or Locality? 10. [Unknown]: Cupertino 11. What is the name of your State or PRovince? 12. [Unknown]: CA 13. What is the two-letter country code for this unit? 14. [Unknown]: US 15. Is <CN=XXXXXXX YYY, OU=Java Software, O=Sun Microsystems, L=Cupertino, ST=CA, C=US> correct? 16. [no]: yes file://確認后按y結束 17. Enter key password for <MyCert> file://鍵入你key的密碼。若按回車次密碼與 鍵入的keystore的密碼相同 18. (RETURN if same as keystore password): ********* 19。使用 "keytool -certreq" 建立一個證書請求文件，拷貝并粘貼到Thawte的 webform上。例如： 20. C:>C:jdk1.3inkeytool -certreq -alias MyCert 21. Enter keystore password: ********* -----BEGIN NEW CERTIFICATE REQUEST----- MIIBTjCCAR8CAQAwdjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwE AYDVQQHEwlDdXBlcnRpbm8xGTAXBgNVBAoTEFN1biBNaWNyb3N5c3RlbX MxFjAUBgNVBAsTDUphdmEgU29mdHdhcmUxEzARBgNVBAMTClN0YW5sZXk gSG8wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALTgU8PovA4y59eb oPjY65BwCSc/zPqtOZKJlaW4WP+UhmebE+T2Mho7P5zXjGf7elo3tV5uI 3vzgGfnhgpf73EoMow8EJhly4w/YsXKqeJEqqvNogzAD+qUv7Ld6dLOv0 CO5qvpmBAO6mfaI1XAgx/4xU/6009jVQe0TgIoocB5AgMBAAGgADANBgk qhkiG9w0BAQQFAAOBgQAWmLrkifKiUYtd4ykhBtPWSwW/IKkgyfIuNMML dF1DH8neSnXf3ZLI32f2yXvs7u3/xn6chnTXh4HYCJoGYOAbB3WNbAoQR i6u6TLLOvgv9pMNUo6v1qB0xly1faizjimVYBwLhOenkA3Bw7S8UIVfdv 84cO9dFUGcr/Pfrl3GtQ== -----END NEW CERTIFICATE REQUEST----- 22。你可以從郵箱里收到Thawte發給你的證書鏈，拷貝她并存處在一個文件中。可以使 用 "keytool -import" 把它導入你的keystore中 23. C:>C:jdk1.3inkeytool -import -alias MyCert -file VSSStanleyNew.cer 24。導入成功后你的證書及證書支持的鏈將生效。你現在可以使用Jarsigner簽名你的 Jar文件了。注重：必須所有的步驟使用同樣的別名或是不使用別名（缺省的別名是 "mykey"）
s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore i = at least one certificate was found in identity scope
