Java has spoken PKCS#11 since 1.4 through the SunPKCS11 provider, so a hardware token can be a KeyStore of type PKCS11 and everything built on KeyStore follows. There is no KeyNub library in this path at all.
A configuration file and a provider
SunPKCS11 is configured with a small text file naming the library and the slot:
name = KeyNublibrary = /usr/lib/opensc-pkcs11.soslotListIndex = 0
Prefer slot with an explicit id, or the token label, over slotListIndex — the index shifts when another reader is attached, and a build that signs with whatever token happens to be in slot zero is a bad afternoon waiting to happen.
Then point the standard tools at it: keytool -keystore NONE -storetype PKCS11 -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11.cfg -list shows what the card holds, and jarsigner takes the same arguments to sign with it.
Signing JARs and artefacts
For code signing this is the whole story: generate the key on the card, get a code-signing certificate issued to it, and hand jarsigner the PKCS11 keystore. Timestamp the signature so it outlives the certificate. Because the key is non-extractable, a compromised build host can be made to sign while it is compromised but cannot take the key away afterwards.
TLS in a JVM server
Tomcat, Jetty and anything else using JSSE can take a PKCS11 keystore for its TLS connector, so the server’s private key stays on the card. Read the limits on TLS server keys first: at 39 ms per EC signature this suits an internal or administrative endpoint, not a high-traffic public one.
Two operational notes. Recent JDKs are stricter about the algorithms a provider may supply, so check that the mechanism you want is not disabled in java.security. And handle the PIN deliberately: a CallbackHandler is the clean way in a long-running server, rather than a password on a command line that ends up in the process list.
Where to go next
Java needs no vendor library for any of this. See also code signing, TLS server keys, the Windows certificate store, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
