Configure a Digital Certificate in a Jenkins Build Step: Jenkins Credentials and Azure Key Vault

1.3.1 Certificate file binding

We will start with binding the secret file we configured earlier to a Jenkins pipeline variable.

1. In your pipeline, switch to the Build Environment section;

2. Check Use secret text(s) or file(s);

3. Click Add and select Secret File;

4. Configure the file binding.

1.3.2 Add the Advanced Installer build step

Switch to the Build section, use Add build step, and select Invoke Advanced Installer.

The relevant setting for this tutorial is the Additional commands field, where you specify the certificate file.

SetDigitalCertificateFile -file "${MY_TEST_CERTIFICATE}"
SetDigitalCertificatePassword -password <certificate_password>

In this example, I used a test certificate file with no password. If your certificate requires a password, you need to add the <certificate_password> command to specify it.

2.1 Preparing the project

1. Launch Advanced Installer and load the AIP file.

2. Switch to the Digital Signature page.

3. In the Software Publisher Certificate group, choose Use from Azure Key Vault and input the required information.

Here's the information you need:

• Tenant ID
• App ID
• Vault Name
• Certificate Name and Version

These settings will be stored in the AIP project file.

During the signing process, Advanced Installer requires the Azure Key Vault Secret. Since this is sensitive information, we do not store it in the project file but will store it as a Secret Text in the Jenkins Credentials Manager.

4. Save and upload the project file in the DevOps repository -- yes, the same one you are using in the Jenkins pipeline.

2.2 Store the Key Vault secret in Jenkins Credentials Manager

Generate a new credential as described in the first part of this tutorial and configure it as follows:

1. Kind: Secret text
2. Scope: Global
3. Secret: your Azure Key Vault secret
4. ID: used for later referencing the secret text

2.3 Configure the pipeline

2.3.1 Certificate file binding

To create the binding, follow the same steps from the first part but select Secret Text instead on Secret File.

Configure the binding as follows:

2.3.2 Configure the Advanced Installer build step

Here, you need to add an Advanced Installer build step and set the Additional commands field to:

SetAzureKeyVaultSecret ${AZURE_KEY_VAULT_SECRET}

Copy

Conclusion

That's it! Now you can easily configure your application's digital signature using a Jenkins build step.

I hope you found this article useful!

For any questions or suggestions feel free to comment down below.