I recently spent a lot of time following what seemed to be simple instructions for creating a self signed cert for an IBM Customized Addon Installer.  Over and over I repeated the steps from the following two links:

https://www-10.lotus.com/ldd/lewiki.nsf/dx/Creating_a_customized_addon_installer?open

https://www.ibm.com/support/knowledgecenter/en/SSKTMJ_9.0.1/admin/inst_signingcustomorthirdpartyfeaturesandpluginsfori_t.html

One step in particular gave me issues, which was exporting the trust certificate (step 8 from the second link).  Basically, my version of Java would not allow an empty password and it kept erroring out on that step.  I tried different versions of Java.  I tried creating my own passwords.  Step 8 allowed me to create my own password, but the final installer wouldn’t work.  Finally, I ran into some plain old Java documentation (not related to IBM stuff), that happened to mention the default Java administration password is “changeit”.  I changed the instructions to include “changeit” as the password in step 8.  Guess what? It worked perfectly.

One other slight gotcha with these instructions, is to be sure you’re in the directory you need to be in for the various steps.  Most likely your Java keytool is in a different directory than you jarsigner.  The instructions look as though they’re installed in the same directory.