Unable to sign with Yubikey on Windows

Hi. I have Windows 10, Yubikey 4 FIPS with SSL.com code signing certificate installed. Yubico-piv-tool is also installed, but I still get error:

c:\build\sign>"c:\Program Files\Java\jre1.8.0_341\bin\java.exe" -Djava.security.debug=sunpkcs11 -jar jsign-4.1.jar --storetype=YUBIKEY test.exe
jsign: Couldn't sign test.exe
java.security.ProviderException: java.io.IOException: The specified module could not be found.
C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll
        at net.jsign.YubiKey.getSunPKCS11Configuration(YubiKey.java:65)
        at net.jsign.YubiKey.getProvider(YubiKey.java:44)
        at net.jsign.SignerHelper.build(SignerHelper.java:361)
        at net.jsign.SignerHelper.sign(SignerHelper.java:562)
        at net.jsign.JsignCLI.execute(JsignCLI.java:117)
        at net.jsign.JsignCLI.main(JsignCLI.java:40)
Caused by: java.io.IOException: The specified module could not be found.
C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll
        at sun.security.pkcs11.wrapper.PKCS11.connect(Native Method)
        at sun.security.pkcs11.wrapper.PKCS11.<init>(PKCS11.java:144)
        at sun.security.pkcs11.wrapper.PKCS11$SynchronizedPKCS11.<init>(PKCS11.java:1583)
        at sun.security.pkcs11.wrapper.PKCS11.getInstance(PKCS11.java:159)
        at net.jsign.YubiKey.getTokenSlot(YubiKey.java:76)
        at net.jsign.YubiKey.getSunPKCS11Configuration(YubiKey.java:60)
        ... 5 more
Try `java -jar jsign.jar --help' for more information.

I’ve tried a lot, including @ebourg recommendations from https://github.com/ebourg/jsign/issues/122 Can anyone help? Thanks.

[ebourg]

Good! I think Jsign could be improved to automatically select the X.509 Certificate for PIV Authentication if it’s the only one available (this seems to be the case when certification authorities deliver an EV certificate on a Yubikey). For now it only looks for X.509 Certificate for Digital Signature by default, and at some point, before setting the java.security.debug property, you should have gotten this error message indicating that the alias was wrong:

No certificate found under the alias 'X.509 Certificate for Digital Signature' in the keystore SunPKCS11-yubikey
(available aliases: X.509 Certificate for PIV Attestation, X.509 Certificate for PIV Authentication)

[rearden-steel]

Strange but it works 🤷‍♂️ 😆