---
updatedAt: 2026-05-21T09:14:56.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/installation/llms.txt
---

# WebStart and Jar Signing

Generate keystores and sign JAR files in Artifactory via keytool for Java Web Start (JNLP) client downloads.

Java Web Start is a technology developed by Sun Microsystems (now Oracle) to allow you to download and run Java applications directly from your browser with one-click activation. For more information on Java Web Start, see the <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/javaws/" target="_blank">Oracle documentation for Java Web Start</a>.

Java Web Start requires that any JAR downloaded is signed by the software vendor. To support this requirement, Artifactory lets you manage a set of signing keys that are used to automatically sign JAR files downloaded from a virtual repository. For instructions on managing signing keys in Artifactory, see [Manage Signing Keys](/governance/docs/change-the-signing-key)

<Callout icon="📘" theme="info">
  **WebUI Changes implemented in Artifactory 7.38.x and above**

  Security is now called **Authentication Providers**. All the relevant text and images on this page have been updated to reflect this change.
</Callout>

## Managing Signing Keys

Signing keys are managed in the **Administration** module under **Authentication Providers**  **| Signing Keys.**

<Callout icon="📘" theme="info">
  **Debian Signing Key**

  Debian signing keys are also managed on this page, but these are not related to JAR signing. For details, refer to **Debian Signing Keys**.
</Callout>

The following topics review how to manage signing keys:

* [Generate JAR Signing Keys](#generate-jar-signing-keys)
* [Set Your Keystore and Keys](#set-your-keystore-and-keys)
* [Remove a Key Pair](#remove-a-key-pair)
* [Configure Virtual Repositories to Sign JARs](#configure-virtual-repositories-to-sign-jars)

## Generate JAR Signing Keys

To sign JAR files, first create a keystore and generate key pairs to add to it. You can create these using Oracle's `keytool` utility, which is built into your Java Runtime Environment (JRE), by running the following command:

```bash
keytool -keystore <keystore filename> -keypass <key_password> -storepass <store_password> -alias <store_alias> \
-genkeypair -dname "cn=<cName>, ou=<orgUnit>, o=<orgName>, S=<stateName>, c=<country>" -validity <days>
```

For details, refer to the Oracle <a href="https://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html" target="_blank">keytool - Key and Certificate Management Tool documentation</a>.

## Set Your Keystore and Keys

Before adding a keystore, set the password required to make future changes to the keystore. You will need this password to remove or update the keystore.

Set the password and click **Create**. This will unlock the rest of the keystore management fields.

<Image alt="ChangeKeystorePwd.jpg" border={false} src="https://files.readme.io/593c2368ea654c26c8b2aaca601661cb18c3c840e1b1d50fc85849f7fe17dc8b-uuid-483483f1-38c1-d038-67d6-e69e3650001e.jpg" />

Once your keystore password is set and you have created a keystore and a set of signing keys, you can add them to Artifactory.

First upload your keystore file under **Add Key-Store** and enter the keystore password. Click "Unlock"

<Image alt="AddKeyStore.jpg" border={false} src="https://files.readme.io/5144cae2c9969ca8f822f9ce1c2e4ff0ba3a85e53b19cb6066d8b708f1d83a0f-uuid-8aadb6b6-35ff-f159-bee9-bdb185d7d403.jpg" />

Once your keystore is set in Artifactory you may add key pairs under **Add Key-Pair.**

<Image alt="AddKeyPair.jpg" border={false} src="https://files.readme.io/7c2633533f5f9b7f1063e0566209d563dfcd98e165e25dd019ffbaa2c7a8ec58-uuid-766ceeb6-4224-16a6-03e9-db344002c90a.jpg" />

## Remove a Key Pair

To remove a key pair, select the key pair and click **Remove**.

<Image alt="RemoveKeyPair.jpg" border={false} src="https://files.readme.io/216ed0699585a344a009eff1455b43f9ab54233271033abf06f99aa88709614a-uuid-8f01f930-d3ac-0b1e-38db-51e2ea2b0bae.jpg" />

## Configure Virtual Repositories to Sign JARs

Once Artifactory has a keystore and key pairs, you can configure a virtual repository with the key pair you wish to use for JAR signing. This is done in the [**Advanced** settings](/artifactory/docs/virtual-repositories) of the virtual repository configuration screen.

<Image alt="key_pair.png" border={false} src="https://files.readme.io/166ea2ea138799165618ccb9d1669abf7a5ccba085a701bd642bb3ccab6eed42-uuid-ee858ac4-3798-6202-fca5-d21fed5284dc.png" />

## Related Topics

* [Artifactory Configuration](configuring-artifactory)
* [RSA Key Pairs](rsa-key-pairs)
* [General Settings](general-settings)
* [Artifactory Configuration Files](artifactory-configuration-files)