---
schema_version: "1"
id: 7b1746af04049f8550d75f6a8902966b8afc7a28c3723970b79affc7550bde0a
title: JAR Signature Validator
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-manager/rtm-agent-jar-signature-validator.md
canonical_url: https://docs.mulesoft.com/runtime-manager/rtm-agent-jar-signature-validator
source_site: docs.mulesoft.com
content_type: documentation
content_hash: e74ba0be67e87dea7f4d3015a380da3be554a45bd5432110c1fbaf6ae0a59538
description: MuleSoft Documentation Site
latest: true
---
---
product: Runtime Manager
---

# JAR Signature Validator

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

[![logo hybrid active](/mulesoft/current/en-us/_/img/icons/hybrid-cloud.svg "Hybrid")Hybrid](deployment-strategies#hybrid-deployments)

By default, the application validator service implements a JAR signature validator to prevent the
deployment of non-authorized artifacts. Each signed entry in the artifact JAR file must match one of
the keystore aliases. You can indicate which keystore alias to use to validate all artifacts
deployed in the runtime. Artifacts signed with expired certificates are allowed.

## Configure the JAR Signature Validator

Modify the `$MULE_HOME/conf/mule-agent.yml` file to include the following:

```java
 services:
  mule.agent.artifact.validator.service:
    enabled: true
    validators:
    - type: jarSignatureValidator
      name: defaultJarSignatureValidator
      enabled: true
      args:
        truststore: signers-truststore.jks
        truststoreType: JKS
        truststoreAlias: code-signer-alias-1
        truststorePassword: '![PBEWITHSHA1ANDDESEDE,U/nA0wV714oNi9LHoAkDtiwg22ngG6b7yFTtg7fk2d4=]'
```

Use the following properties to configure the JAR signature validator:

<table><colgroup><col> <col></colgroup><thead><tr><th>Key</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>type</code></p></div></div></td><td><div><div><p>Required. <code>jarSignatureValidator</code> is the validator type implemented in the Runtime Manager agent plugin to verify the signature of all JAR files used for deployments in Mule runtime.</p></div></div></td></tr><tr><td><div><div><p><code>name</code></p></div></div></td><td><div><div><p>Required. A validator type can have multiple implementations. The name for the <code>jarSignatureValidator</code> type implemented in the Runtime Manager agent is <code>defaultJarSignatureValidator</code>.</p></div></div></td></tr><tr><td><div><div><p><code>enabled</code></p></div></div></td><td><div><div><p>Optional. Set to <code>true</code> to enable the validator implementation or <code>false</code> to disable it. The default value is <code>true</code>.</p></div></div></td></tr></tbody></table>

Use the following arguments to configure the JAR signature validator:

<table><colgroup><col> <col></colgroup><thead><tr><th>Key</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>truststore</code></p></div></div></td><td><div><div><p>Optional. The truststore filename that contains one or more certificates used to validate the signature of all JAR files that you use for deployments. The default location is <code>$MULE_HOME/conf</code>. You can use a relative path to reference the truststore file. If you don’t provide a path, the validator loads the cacerts truststore file used by the JVM.</p></div></div></td></tr><tr><td><div><div><p><code>truststoreType</code></p></div></div></td><td><div><div><p>Optional. <code>JKS</code> (default) or <code>PKCS12</code>.</p></div></div></td></tr><tr><td><div><div><p><code>truststoreAlias</code></p></div></div></td><td><div><div><p>Optional. Each certificate stored in a truststore file is identified by an alias string. This property specifies a single alias used to validate all JAR files. If you don’t provide an alias, the validator uses all certificates in the truststore file to match the signature in the JAR files.</p></div></div></td></tr><tr><td><div><div><p><code>truststorePassword</code></p></div></div></td><td><div><div><p>Optional for JKS, required for PKCS12. The truststore file password.</p></div></div></td></tr></tbody></table>

## Start Mule Runtime Engine

Start Mule runtime engine and verify that the validator configuration is successful. The console
shows the following logs:

```console
AgentApplicationValidatorService: Initializing Artifact Validator service
AgentApplicationValidatorService: Total validators loaded: 1
AgentApplicationValidatorService: Validators listed by type:
AgentApplicationValidatorService: Type: jarSignatureValidator Names: [defaultJarSignatureValidator]
```

## Use Case 1: Deploy a JAR File Signed by a Trusted Code Signer - Success

Required files:

- `app-signed-by-trust-signer-01.jar`

- `signers-truststore.jks`

File: `mule-agent.yaml`

```java
 services:
  mule.agent.artifact.validator.service:
    enabled: true
    validators:
    - type: jarSignatureValidator
      name: defaultJarSignatureValidator
      enabled: true
      args:
        truststore: signers-truststore.jks
        truststoreType: JKS
        truststorePassword: mulesoft
```

Curl command:

```copy
curl -X PUT 'http://localhost:9999/mule/applications/app-signed-by-trust-signer-01' \
     -H 'Content-Type: application/json' \
     -d '{"url": "file:/tmp/yahoo/app-signed-by-trust-signer-01.jar", \
          "configuration": {}
         }'
```

Response:

```json
{
  "application": {
    "name": "app-signed-by-trust-signer-01"
  },
  "status": "Deployment attempt started"
}
```

Console logs:

```console
AgentApplicationService: Deploying the app-signed-by-trust-signer-01 application from URL file:/tmp/yahoo/app-signed-by-trust-signer-01.jar
KeystoreUtils: Loading Jar Signers Truststore from '/private/tmp/trash/server-yahoo/conf/signers-truststore.jks'
JarSigner: Jar Signature verified: File /var/folders/sq/71l1hxdn171dpc46fn675yk80000gq/T/mule-received-artifact-5158252349422012120/app-signed-by-trust-signer-01.jar
AgentApplicationValidatorService: Application validation success for application: 'app-signed-by-trust-signer-01'
```

## Use Case 2: Deploy a JAR File Signed by a Trusted Code Signer and Validate with the Truststore Alias Signer - Success

Required files:

- `app-signed-by-trust-signer-01.jar`

- `signers-truststore.jks`

File: `mule-agent.yaml`

```java
 services:
  mule.agent.artifact.validator.service:
    enabled: true
    validators:
    - type: jarSignatureValidator
      name: defaultJarSignatureValidator
      enabled: true
      args:
        truststore: signers-truststore.jks
        truststoreType: JKS
        truststoreAlias: code-signer-alias-01
        truststorePassword: mulesoft
```

Curl command:

```copy
curl -X PUT http://localhost:9999/mule/applications/app-signed-by-trust-signer-01
     -H "Content-Type: application/json"
     -d '{"url": "file:/tmp/yahoo/app-signed-by-trust-signer-01.jar",\
          "configuration": {}
         }'
```

Response:

```json
{
  "application": {
    "name": "app-signed-by-trust-signer-01"
  },
  "status": "Deployment attempt started"
}
```

Console logs:

```console
AgentApplicationService: Deploying the app-signed-by-trust-signer-01 application from URL file:/tmp/yahoo/app-signed-by-trust-signer-01.jar
KeystoreUtils: Loading Jar Signers Truststore from '/private/tmp/trash/server-yahoo/conf/signers-truststore.jks'
JarSigner: Jar Signature verified using certificate alias 'code-signer-alias-01': File '/var/folders/sq/71l1hxdn171dpc46fn675yk80000gq/T/mule-received-artifact-3796117303843373481/app-signed-by-trust-signer-01.jar'
AgentApplicationValidatorService: Application validation success for application: 'app-signed-by-trust-signer-01'
```

## Use Case 3: Deploy a JAR File Signed by an Expired Code Signer - Failed

Required files:

- `app-signed-by-expired-trusted-signer.jar`

- `signers-truststore.jks`

File: `mule-agent.yaml`

```java
services:
  mule.agent.artifact.validator.service:
    enabled: true
    validators:
    - type: jarSignatureValidator
      name: defaultJarSignatureValidator
      enabled: true
      args:
        truststore: signers-truststore.jks
        truststoreType: JKS
        truststoreAlias: expired-code-signer
        truststorePassword: mulesoft
```

Curl command:

```copy
curl -X PUT http://localhost:9999/mule/applications/app-signed-by-expired-trusted-signer \
     -H "Content-Type: application/json"
     -d '{"url": "file:/tmp/yahoo/app-signed-by-expired-trusted-signer.jar", \
          "configuration": {}
         }'
```

Response:

```json
{
  "type": "class com.mulesoft.agent.exception.ApplicationValidationException",
  "message": "CertificateExpiredException - NotAfter: Wed Dec 22 14:45:54 AST 2021"
}
```

Console logs:

```console
AgentApplicationService: Deploying the app-signed-by-expired-trusted-signer application from URL file:/tmp/yahoo/app-signed-by-expired-trusted-signer.jar
KeystoreUtils: Loading Jar Signers Truststore from '/private/tmp/trash/server-yahoo/conf/signers-truststore.jks'
MuleAgentSignatureValidator: There was an error validating the certificate with the alias 'expired-code-signer' - CertificateExpiredException Reason: 'NotAfter: Wed Dec 22 14:45:54 AST 2021'
ApplicationsRequestHandler: Error performing the deployment of app-signed-by-expired-trusted-signer. Cause: ApplicationValidationException: CertificateExpiredException - NotAfter: Wed Dec 22 14:45:54 AST 2021
```

## See Also

- [Runtime Manager Agent](https://docs.mulesoft.com/runtime-manager/runtime-manager-agent)

- [Advanced Usage](https://docs.mulesoft.com/runtime-manager/advanced-usage)

- [Application Validator Service](https://docs.mulesoft.com/runtime-manager/rtm-agent-app-validator)