Digicert and Google Cloud KMS - Oauth2??

[extremecarver]

I don't manage to get jsign to work, a similar command with signtool works without problems. I authenticated using google CNG Provider. My problem is that signtool frequently crashes if it runs several instances simultaneously (was okay using pfx but not with cloud hosted key). With jsign however i get stuck:

I tried already using full pem and using only private crt (as for signtool), also removing /cryptoKeyVersions/1 from alias doesn't change much (then the error starts with jsign: Failed to retrieve the private key from the keystore )

Could someone give a step by step how to authenticate jsign with google hsm?

C:\Users\me >java -jar C:\jsign-7.4.jar --verbose --storetype GOOGLECLOUD --storepass "%GOOGLE_TOKEN%" --keystore "projects/XXX/locations/global/keyRings/XXX_Keyring" --alias Sectigo_Key/cryptoKeyVersions/1 --certfile C:\mycert.crt --tsaurl http://timestamp.sectigo.com C:\test.exe
Adding Authenticode signature to C:\test.exe
jsign: Couldn't sign C:\test.exe
net.jsign.bouncycastle.operator.RuntimeOperatorException: exception obtaining signature: java.security.GeneralSecurityException: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.bouncycastle.operator.jcajce.JcaContentSignerBuilder$1.getSignature(JcaContentSignerBuilder.java:249)
at net.jsign.bouncycastle.cms.SignerInfoGenerator.generate(SignerInfoGenerator.java:176)
at net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generateSignerInfo(CMSSignedDataGenerator.java:247)
at net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generate(CMSSignedDataGenerator.java:186)
at net.jsign.asn1.authenticode.AuthenticodeSignedDataGenerator.getSignerInfo(AuthenticodeSignedDataGenerator.java:56)
at net.jsign.asn1.authenticode.AuthenticodeSignedDataGenerator.generate(AuthenticodeSignedDataGenerator.java:43)
at net.jsign.AuthenticodeSigner.createSignedData(AuthenticodeSigner.java:393)
at net.jsign.AuthenticodeSigner.sign(AuthenticodeSigner.java:370)
at net.jsign.SignerHelper.sign(SignerHelper.java:475)
at net.jsign.SignerHelper.execute(SignerHelper.java:325)
at net.jsign.JsignCLI.execute(JsignCLI.java:229)
at net.jsign.JsignCLI.main(JsignCLI.java:58)
Caused by: java.security.SignatureException: java.security.GeneralSecurityException: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:48)
at java.base/java.security.Signature$Delegate.engineSign(Signature.java:1410)
at java.base/java.security.Signature.sign(Signature.java:713)
at net.jsign.bouncycastle.operator.jcajce.JcaContentSignerBuilder$1.getSignature(JcaContentSignerBuilder.java:245)
... 11 more
Caused by: java.security.GeneralSecurityException: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.jca.GoogleCloudSigningService.sign(GoogleCloudSigningService.java:201)
at net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:46)
... 14 more
Caused by: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.jca.RESTClient.query(RESTClient.java:190)
at net.jsign.jca.RESTClient.post(RESTClient.java:74)
at net.jsign.jca.GoogleCloudSigningService.sign(GoogleCloudSigningService.java:196)
... 15 more

[ebourg]

Are you sure the authentication token is still valid?

[extremecarver]

Yes I think so. I followed another guide for jsign and I think the authentication is a bit different but I also approved it.

However I got signtool working without problems now after switching to the newest 64bit Version. So after spending 3-4 hours trying to get jsign working I stopped trying to find a solution why it doesn't work.

[ebourg]

May I ask how you generated the token? Is it the same token used by the Google CNG Provider?

[extremecarver]

I followed through this guide
https://docs.cloud.google.com/kms/docs/reference/pkcs11-jsign

And this Guide:
https://signmycode.com/resources/how-to-configure-google-cloudhsm-to-sign-windows-executables

And installed this for authentication:
https://github.com/GoogleCloudPlatform/kms-integrations/releases?q=cng&expanded=true

Plus maybe some more. I got lost by all the tools I installed in trying to get it running. There was definitely another tool I ran or insrslled for authentication but I don't know which anymore.

[extremecarver]

A yeah I definitely also installed
https://docs.cloud.google.com/sdk/docs/install-sdk

And then ran the
gcloud auth print-access-token
Command from cmd.exe

[ebourg]

That looks good. Jsign was invoked immediately after generating the token? How did you assign its value to the GOOGLE_TOKEN environment variable?

[extremecarver]

I have no clue, here is a redacted console copy:
C:\Users\Name>gcloud auth print-access-token
ya29.c.c0AYnqXlghD1wGAMWIC0zXSQmVUqmjErH4gh8439ny5PBzHCNOSyofPoiqhX_N0XIt_PjWuK...scrambled

C:\Users\Name>java -jar C:\domain\jsign-7.4.jar --verbose --storetype GOOGLECLOUD --storepass "C:\domain\domain_svn\valued-bivouac-yyyy.json" --keystore "projects/valued-bivouac-yyyy/locations/global/keyRings/Sectigo_Keyring" --alias Sectigo_Key --certfile C:\domain\domain_svn\Name_lastname.pem --tsaurl http://timestamp.sectigo.com C:\domain\filename.exe
jsign: Failed to retrieve the private key from the keystore
java.security.UnrecoverableKeyException: Unable to fetch Google Cloud private key 'projects/valued-bivouac-yyyy/locations/global/keyRings/Sectigo_Keyring/cryptoKeys/Sectigo_Key'
at net.jsign.jca.GoogleCloudSigningService.getPrivateKey(GoogleCloudSigningService.java:173)
at net.jsign.jca.SigningServiceKeyStore.engineGetKey(SigningServiceKeyStore.java:36)
at java.base/java.security.KeyStore.getKey(KeyStore.java:1074)
at net.jsign.SignerHelper.build(SignerHelper.java:417)
at net.jsign.SignerHelper.sign(SignerHelper.java:471)
at net.jsign.SignerHelper.execute(SignerHelper.java:325)
at net.jsign.JsignCLI.execute(JsignCLI.java:229)
at net.jsign.JsignCLI.main(JsignCLI.java:58)
Caused by: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.jca.RESTClient.query(RESTClient.java:190)
at net.jsign.jca.RESTClient.get(RESTClient.java:70)
at net.jsign.jca.GoogleCloudSigningService.getPrivateKey(GoogleCloudSigningService.java:162)
... 7 more
Try `java -jar jsign.jar --help' for more information.

C:\Users\Name>java -jar C:\domain\jsign-7.4.jar --verbose --storetype GOOGLECLOUD --storepass "$(gcloud auth application-default print-access-token)" --keystore "projects/valued-bivouac-yyyy/locations/global/keyRings/Sectigo_Keyring" --alias Sectigo_Key/cryptoKeyVersions/1 --certfile C:\domain\domain_svn\Name_lastname.crt --tsaurl http://timestamp.sectigo.com C:\domain\filename.exe
Adding Authenticode signature to C:\domain\filename.exe
jsign: Couldn't sign C:\domain\filename.exe
net.jsign.bouncycastle.operator.RuntimeOperatorException: exception obtaining signature: java.security.GeneralSecurityException: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.bouncycastle.operator.jcajce.JcaContentSignerBuilder$1.getSignature(JcaContentSignerBuilder.java:249)
at net.jsign.bouncycastle.cms.SignerInfoGenerator.generate(SignerInfoGenerator.java:176)
at net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generateSignerInfo(CMSSignedDataGenerator.java:247)
at net.jsign.bouncycastle.cms.CMSSignedDataGenerator.generate(CMSSignedDataGenerator.java:186)
at net.jsign.asn1.authenticode.AuthenticodeSignedDataGenerator.getSignerInfo(AuthenticodeSignedDataGenerator.java:56)
at net.jsign.asn1.authenticode.AuthenticodeSignedDataGenerator.generate(AuthenticodeSignedDataGenerator.java:43)
at net.jsign.AuthenticodeSigner.createSignedData(AuthenticodeSigner.java:393)
at net.jsign.AuthenticodeSigner.sign(AuthenticodeSigner.java:370)
at net.jsign.SignerHelper.sign(SignerHelper.java:475)
at net.jsign.SignerHelper.execute(SignerHelper.java:325)
at net.jsign.JsignCLI.execute(JsignCLI.java:229)
at net.jsign.JsignCLI.main(JsignCLI.java:58)
Caused by: java.security.SignatureException: java.security.GeneralSecurityException: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:48)
at java.base/java.security.Signature$Delegate.engineSign(Signature.java:1410)
at java.base/java.security.Signature.sign(Signature.java:713)
at net.jsign.bouncycastle.operator.jcajce.JcaContentSignerBuilder$1.getSignature(JcaContentSignerBuilder.java:245)
... 11 more
Caused by: java.security.GeneralSecurityException: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.jca.GoogleCloudSigningService.sign(GoogleCloudSigningService.java:201)
at net.jsign.jca.SigningServiceSignature.engineSign(SigningServiceSignature.java:46)
... 14 more
Caused by: java.io.IOException: 401 - UNAUTHENTICATED: Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
at net.jsign.jca.RESTClient.query(RESTClient.java:190)
at net.jsign.jca.RESTClient.post(RESTClient.java:74)
at net.jsign.jca.GoogleCloudSigningService.sign(GoogleCloudSigningService.java:196)
... 15 more
Try `java -jar jsign.jar --help' for more information.

[extremecarver]

I'm not sure what cert to use (fullchain or private only) - I guess the try were it starts with Adding Authenticode to .... is the correct one