DevEcoStudio版本：DevEcoStudio3.1Release（3.1.0.500）
SDK版本：3.2.12.5（FullSDK）
开发板型号：DAYU200
系统版本：OpenHarmony3.2Release
OpenHarmony系统中有一套默认签名信息，用于应用的开发和调试。当系统厂商正式发布系统时，需要新增或替换私有签名信息，本篇文档将介绍如何生成私有签名并在系统中进行配置。本文档需准备Java和Gradle编译环境。
Profile签名场景：
应用签名场景：
gradlebuild或者gradlejar
developtools_hapsigner/hapsigntool/hap_sign_tool/build/libs/hap-sign-tool.jar
generate-keypair:├──-keyAlias#密钥别名，必填项├──-keyPwd#密钥口令，可选项├──-keyAlg#密钥算法，必填项，包括RSA/ECC├──-keySize#密钥长度，必填项，RSA算法的长度为2048/3072/4096，ECC算法的长度NIST-P-256/NIST-P-384├──-keystoreFile#密钥库文件，必填项，JKS或P12格式├──-keystorePwd#密钥库口令，可选项
generate-csr:├──-keyAlias#密钥别名，必填项├──-keyPwd#密钥口令，可选项├──-subject#证书主题，必填项├──-signAlg#签名算法，必填项，包括SHA256withRSA/SHA384withRSA/SHA256withECDSA/SHA384withECDSA├──-keystoreFile#密钥库文件，必填项，JKS或P12格式├──-keystorePwd#密钥库口令，可选项├──-outFile#输出文件，可选项，如果不填，则直接输出到控制台
generate-ca:├──-keyAlias#密钥别名，必填项├──-keyPwd#密钥口令，可选项├──-keyAlg#密钥算法，必填项，包括RSA/ECC├──-keySize#密钥长度，必填项，RSA算法的长度为2048/3072/4096，ECC算法的长度NIST-P-256/NIST-P-384├──-issuer#颁发者的主题，可选项，如果不填，表示根CA├──-issuerKeyAlias#颁发者的密钥别名，可选项，如果不填，表示根CA├──-issuerKeyPwd#颁发者的密钥口令，可选项├──-subject#证书主题，必填项├──-validity#证书有效期，可选项，默认为3650天├──-signAlg#签名算法，必填项，包括SHA256withRSA/SHA384withRSA/SHA256withECDSA/SHA384withECDSA├──-basicConstraintsPathLen#路径长度，可选项，默认为0├──-issuerKeystoreFile#签发者密钥库文件，可选项，JKS或P12格式├──-issuerKeystorePwd#签发者密钥库口令，可选项├──-keystoreFile#密钥库文件，必填项，JKS或P12格式├──-keystorePwd#密钥库口令，可选项├──-outFile#输出文件，可选项，如果不填，则直接输出到控制台
generate-app-cert:├──-keyAlias#密钥别名，必填项├──-keyPwd#密钥口令，可选项├──-issuer#颁发者的主题，必填项├──-issuerKeyAlias#颁发者的密钥别名，必填项├──-issuerKeyPwd#颁发者的密钥口令，可选项├──-subject#证书主题，必填项├──-validity#证书有效期，可选项，默认为3650天├──-signAlg#签名算法，必填项，包括SHA256withECDSA/SHA384withECDSA；├──-keystoreFile#密钥库文件，必填项，JKS或P12格式├──-keystorePwd#密钥库口令，可选项├──-issuerKeystoreFile#签发者密钥库文件，可选项，JKS或P12格式├──-issuerKeystorePwd#签发者密钥库口令，可选项├──-outForm#输出证书文件的格式，包括cert/certChain，可选项，默认为certChain├──-rootCaCertFile#outForm为certChain时必填，根CA证书文件├──-subCaCertFile#outForm为certChain时必填，中间CA证书文件├──-outFile#输出证书文件(证书或证书链)，可选项，如果不填，则直接输出到控制台
generate-profile-cert:├──-keyAlias#密钥别名，必填项├──-keyPwd#密钥口令，可选项├──-issuer#颁发者的主题，必填项├──-issuerKeyAlias#颁发者的密钥别名，必填项├──-issuerKeyPwd#颁发者的密钥口令，可选项├──-subject#证书主题，必填项├──-validity#证书有效期，可选项，默认为3650天├──-signAlg#签名算法，必填项，包括SHA256withECDSA/SHA384withECDSA；├──-keystoreFile#密钥库文件，必填项，JKS或P12格式├──-keystorePwd#密钥库口令，可选项├──-issuerKeystoreFile#签发者密钥库文件，可选项，JKS或P12格式├──-issuerKeystorePwd#签发者密钥库口令，可选项├──-outForm#输出证书文件的格式，包括cert/certChain，可选项，默认为certChain├──-rootCaCertFile#outForm为certChain时必填，根CA证书文件├──-subCaCertFile#outForm为certChain时必填，中间CA证书文件├──-outFile#输出证书文件(证书或证书链)，可选项，如果不填，则直接输出到控制台
sign-profile:├──-mode#签名模式，必填项，包括localSign，remoteSign├──-keyAlias#密钥别名，必填项├──-keyPwd#密钥口令，可选项├──-profileCertFile#Profile签名证书（证书链，顺序为最终实体证书-中间CA证书-根证书），必填项├──-inFile#输入的原始ProvisionProfile文件，必填项├──-signAlg#签名算法，必填项，包括SHA256withECDSA/SHA384withECDSA├──-keystoreFile#密钥库文件，localSign模式时为必填项，JKS或P12格式├──-keystorePwd#密钥库口令，可选项├──-outFile#输出签名后的ProvisionProfile文件，p7b格式，必填项
verify-profile:├──-inFile#已签名的ProvisionProfile文件，p7b格式，必填项├──-outFile#验证结果文件（包含验证结果和profile内容），json格式，可选项；如果不填，则直接输出到控制台
sign-app:├──-mode#签名模式，必填项，包括localSign，remoteSign，remoteResign├──-keyAlias#密钥别名，必填项├──-keyPwd#密钥口令，可选项├──-appCertFile#应用签名证书文件（证书链，顺序为最终实体证书-中间CA证书-根证书），必填项├──-profileFile#签名后的ProvisionProfile文件名，profileSigned为1时为p7b格式，profileSigned为0时为json格式,必填项├──-profileSigned#指示profile文件是否带有签名，1表示有签名，0表示没有签名，默认为1。可选项├──-inForm#输入的原始文件的格式，zip格式或bin格式，默认zip格式，可选项├──-inFile#输入的原始APP包文件，zip格式或bin格式，必填项├──-signAlg#签名算法，必填项，包括SHA256withECDSA/SHA384withECDSA├──-keystoreFile#密钥库文件，localSign模式时为必填项，JKS或P12格式├──-keystorePwd#密钥库口令，可选项├──-outFile#输出签名后的包文件，必填项
verify-app:├──-inFile#已签名的应用包文件，zip格式或bin格式，必填项├──-outCertChain#签名的证书链文件，必填项├──-outProfile#应用包中的profile文件，必填项生成签名文件
java-jarhap-sign-tool.jargenerate-keypair-keyAlias"OpenHarmony-Tizi"-keyAlg"ECC"-keySize"NIST-P-256"-keystoreFile"OpenHarmony-Tizi.p12"-keyPwd"Pwd-Tizi-1"-keystorePwd"Pwd-Tizi-2"
java-jarhap-sign-tool.jargenerate-ca-keyAlias"OpenHarmony-Tizi-rootCA"-signAlg"SHA256withECDSA"-keyAlg"ECC"-keySize"NIST-P-256"-subject"C=CN,O=OpenHarmony-Tizi-rootCA,OU=OpenHarmony-Tizi-rootCACommunity,CN=OpenHarmonyApplicationRootCA"-keystoreFile"OpenHarmony-Tizi.p12"-outFile"OpenHarmony-Tizi-rootCA.cer"-keyPwd"Pwd-Tizi-3"-keystorePwd"Pwd-Tizi-2"-validity"365"
java-jarhap-sign-tool.jargenerate-ca-keyAlias"OpenHarmony-Tizi-subCA"-signAlg"SHA256withECDSA"-keyAlg"ECC"-keySize"NIST-P-256"-subject"C=CN,O=OpenHarmony-Tizi-subCA,OU=OpenHarmony-Tizi-subCACommunity,CN=OpenHarmonyApplicationSubCA"-keystoreFile"OpenHarmony-Tizi.p12"-outFile"OpenHarmony-Tizi-subCA.cer"-keyPwd"Pwd-Tizi-4"-keystorePwd"Pwd-Tizi-2"-issuer"C=CN,O=OpenHarmony-Tizi-rootCA,OU=OpenHarmony-Tizi-rootCACommunity,CN=OpenHarmonyApplicationRootCA"-issuerKeyAlias"OpenHarmony-Tizi-rootCA"-issuerKeyPwd"Pwd-Tizi-3"-validity"365"
java-jarhap-sign-tool.jargenerate-app-cert-keyAlias"OpenHarmony-Tizi-subCA"-signAlg"SHA256withECDSA"-subject"C=CN,O=OpenHarmony-Tizi-app-cert,OU=OpenHarmony-Tizi-app-certCommunity,CN=OpenHarmonyApplicationRelease"-keystoreFile"OpenHarmony-Tizi.p12"-subCaCertFile"OpenHarmony-Tizi-subCA.cer"-rootCaCertFile"OpenHarmony-Tizi-rootCA.cer"-outForm"certChain"-outFile"OpenHarmony-Tizi-app-cert.pem"-keyPwd"Pwd-Tizi-4"-keystorePwd"Pwd-Tizi-2"-issuer"C=CN,O=OpenHarmony-Tizi-subCA,OU=OpenHarmony-Tizi-subCACommunity,CN=OpenHarmonyApplicationSubCA"-issuerKeyAlias"OpenHarmony-Tizi-subCA"-issuerKeyPwd"Pwd-Tizi-4"-validity"365"
java-jarhap-sign-tool.jargenerate-ca-keyAlias"OpenHarmony-Tizi-profileCA"-signAlg"SHA256withECDSA"-keyAlg"ECC"-keySize"NIST-P-256"-subject"C=CN,O=OpenHarmony-Tizi-subCA,OU=OpenHarmony-Tizi-subCACommunity,CN=OpenHarmonyApplicationCA"-keystoreFile"OpenHarmony-Tizi.p12"-outFile"OpenHarmony-Tizi-profileCA.cer"-keyPwd"Pwd-Tizi-5"-keystorePwd"Pwd-Tizi-2"-issuer"C=CN,O=OpenHarmony-Tizi-rootCA,OU=OpenHarmony-Tizi-rootCACommunity,CN=OpenHarmonyApplicationRootCA"-issuerKeyAlias"OpenHarmony-Tizi-rootCA"-issuerKeyPwd"Pwd-Tizi-3"-validity"365"
java-jarhap-sign-tool.jargenerate-profile-cert-keyAlias"OpenHarmony-Tizi-profileCA"-signAlg"SHA256withECDSA"-subject"C=CN,O=OpenHarmony-Tizi-profile-cert,OU=OpenHarmony-Tizi-profile-certCommunity,CN=OpenHarmonyApplicationProfileRelease"-keystoreFile"OpenHarmony-Tizi.p12"-subCaCertFile"OpenHarmony-Tizi-profileCA.cer"-rootCaCertFile"OpenHarmony-Tizi-rootCA.cer"-outForm"certChain"-outFile"OpenHarmony-Tizi-profile-cert-release.pem"-keyPwd"Pwd-Tizi-5"-keystorePwd"Pwd-Tizi-2"-issuer"C=CN,O=OpenHarmony-Tizi-subCA,OU=OpenHarmony-Tizi-subCACommunity,CN=OpenHarmonyApplicationCA"-issuerKeyAlias"OpenHarmony-Tizi-profileCA"-issuerKeyPwd"Pwd-Tizi-5"-validity"365"
java-jarhap-sign-tool.jargenerate-profile-cert-keyAlias"OpenHarmony-Tizi-profileCA"-signAlg"SHA256withECDSA"-subject"C=CN,O=OpenHarmony-Tizi-profile-cert,OU=OpenHarmony-Tizi-profile-certCommunity,CN=OpenHarmonyApplicationProfileDebug"-keystoreFile"OpenHarmony-Tizi.p12"-subCaCertFile"OpenHarmony-Tizi-profileCA.cer"-rootCaCertFile"OpenHarmony-Tizi-rootCA.cer"-outForm"certChain"-outFile"OpenHarmony-Tizi-profile-cert-debug.pem"-keyPwd"Pwd-Tizi-5"-keystorePwd"Pwd-Tizi-2"-issuer"C=CN,O=OpenHarmony-Tizi-subCA,OU=OpenHarmony-Tizi-subCACommunity,CN=OpenHarmonyApplicationCA"-issuerKeyAlias"OpenHarmony-Tizi-profileCA"-issuerKeyPwd"Pwd-Tizi-5"-validity"365"
转换前：
java-jarhap-sign-tool.jarsign-profile-keyAlias"OpenHarmony-Tizi-profileCA"-signAlg"SHA256withECDSA"-mode"localSign"-profileCertFile"OpenHarmony-Tizi-profile-cert-release.pem"-inFile"UnsgnedReleasedProfileTemplate.json"-keystoreFile"OpenHarmony-Tizi.p12"-outFile"com.openharmony.signtest.p7b"-keyPwd"Pwd-Tizi-5"-keystorePwd"Pwd-Tizi-2"
java-jarhap-sign-tool.jarsign-app-keyAlias"OpenHarmony-Tizi-subCA"-signAlg"SHA256withECDSA"-mode"localSign"-appCertFile"OpenHarmony-Tizi-app-cert.pem"-profileFile"com.openharmony.signtest.p7b"-inFile"entry-default-unsigned.hap"-keystoreFile"OpenHarmony-Tizi.p12"-outFile"entry-default-signed.hap"-keyPwd"Pwd-Tizi-4"-keystorePwd"Pwd-Tizi-2"
{"name":"OpenHarmony-Tiziapps","app-signing-cert":"C=CN,O=OpenHarmony-Tizi-app-cert,OU=OpenHarmony-Tizi-app-certCommunity,CN=OpenHarmonyApplicationRelease","profile-signing-certificate":"C=CN,O=OpenHarmony-Tizi-profile-cert,OU=OpenHarmony-Tizi-profile-certCommunity,CN=OpenHarmonyApplicationProfileRelease","profile-debug-signing-certificate":"C=CN,O=OpenHarmony-Tizi-profile-cert,OU=OpenHarmony-Tizi-profile-certCommunity,CN=OpenHarmonyApplicationProfileDebug","issuer-ca":"C=CN,O=OpenHarmony-Tizi-subCA,OU=OpenHarmony-Tizi-subCACommunity,CN=OpenHarmonyApplicationCA","max-certs-path":3,"critialcal-cert-extension":["keyusage"]}
很完整的实践流程
私有签名配置如何导入IDE呢，我进行IDE手动配置时Certpathfile(*.cer)不知道配置哪一个，导致hap编译失败，出现诸如这类错误：
Details:Profilecert'C:/Users/xxx/Desktop/demo/OpenHarmony-Tizi.cer'mustacertchain
Detail:Pleasecheckthemessagefromtools.
通过java-jarhap-sign-tool.jarsign-app命令签名后的hap可以正常安装和运行。
按照上面说的直接修改PEM后缀为CER或者
运行hap-sign-tool.jargenerate-app-cert命令生成时将后缀改为CER，IDE编译还是报错：
>hvigorERROR:Failed:entry:default@SignHap...
>hvigorERROR:Toolsexecutionfailed.
06-2515:53:41ERROR-hap-sign-tool:error:{errorcode:0,message:generateSignerBlockfailed}
com.ohos.hapsigntool.hap.exception.SignatureException:{errorcode:0,message:generateSignerBlockfailed}
atcom.ohos.hapsigntool.hap.sign.SignHap.generateHapSignatureSchemeBlock(SignHap.java:304)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.sign.SignHap.generateHapSigningBlock(SignHap.java:202)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.sign.SignHap.getHapSigningBlock(SignHap.java:190)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.sign.SignHap.sign(SignHap.java:350)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.provider.SignProvider.sign(SignProvider.java:302)[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.api.SignToolServiceImpl.signHap(SignToolServiceImpl.java:319)[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.HapSignTool.runSignApp(HapSignTool.java:285)[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.HapSignTool.dispatchParams(HapSignTool.java:152)[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.HapSignTool.processCmd(HapSignTool.java:109)[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.HapSignTool.main(HapSignTool.java:79)[hap-sign-tool.jar:]
Causedby:com.ohos.hapsigntool.hap.exception.SignatureException:{errorcode:0,message:Signaturedidnotverify}
atcom.ohos.hapsigntool.hap.sign.BcPkcs7Generator.verifySignatureFromServer(BcPkcs7Generator.java:252)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.sign.BcPkcs7Generator.getSignerInfo(BcPkcs7Generator.java:164)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.sign.BcPkcs7Generator.generateSignedData(BcPkcs7Generator.java:91)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.sign.SignHap.generateSignerBlock(SignHap.java:331)~[hap-sign-tool.jar:]
atcom.ohos.hapsigntool.hap.sign.SignHap.generateHapSignatureSchemeBlock(SignHap.java:302)~[hap-sign-tool.jar:]
...9more
>hvigorERROR:BUILDFAILEDin4s838ms
使用的PEM文件为OpenHarmony-Tizi-app-cert.pem，更改为CER。
感谢大佬指导，keyAlias和keyPassword更正后验证OK
官方Docs中现在暂时没有文档进行说明。
大佬，本篇是演示了release版本的签名，看第7步已经生成了应用Debug版profile调试/发布证书，但是想问一下应该怎么使用呢；和使用release版的证书的区别在哪里；我通过第9步进行ProvisionProfile文件签名，生成了debug级的p7b，然后将ide里p7b文件那栏换成了生成的debug的p7b，编译成功但是install失败，报的错是"error:signatureverificationfailedduetonottrustedappsource."，在这之前使用release的p7b去install应用是ok的，请问一下是什么原因导致的，是我哪里没有配置或者更改吗？
检查一下是否把第7步中的，subject配置到了trusted_apps_sources.json中的profile-debug-signing-certificate项里。
有的，配置了
在用ide编译私有签名应用的时候，正常来说只需要一个p12，一个cer，一个release或者一个debug的p7b就可以了对吧
我有试过：在处理UnsgnedReleasedProfileTemplate.json文件的时候，type字段改成debug，但直接就无法生成debug.p7b了，报错："RequirecertinbundleInfo"；大佬有试过使用debug等级的p7b进行签名编译安装吗？
我也是遇到了跟您一样的轻松是一模一样的配置，但是在Openharmony4.0上是ok的，但是升级之后在Openharmony4.1上就是不行，死活都不行呢