Signed java applet blocked by security setting

Question

I have a very basic Java Applet signed with my own certificate. When I try it out on my website I get the message that the application is blocked by security settings.

This is what I did. I signed the jar file using the jarsigner tool:

jarsigner -keystore keystore.p12 -storetype pkcs12  -tsa http://timestamp.comodoca.com/rfc3161 TestApplet1.jar codesign

When I verify the jar it all looks fine to me:

$ jarsigner -verify -verbose -certs TestApplet1.jar

s k      415 Thu Oct 09 12:19:18 CEST 2014 META-INF/MANIFEST.MF

      [entry was signed on 9-10-14 12:19]
      X.509, [email protected], CN=codesigning 2014, OU=Test, O="Test BV ", L=Stad, ST=ZH, C=NL (codesign)
      [certificate is valid from 11-8-14 11:19 to 11-8-15 11:29]
      X.509, CN=CA-TEST (ca-test)
      [certificate is valid from 23-2-11 9:37 to 23-2-16 9:46]

         496 Thu Oct 09 12:19:18 CEST 2014 META-INF/CODESIGN.SF
        4666 Thu Oct 09 12:19:18 CEST 2014 META-INF/CODESIGN.RSA
smk      226 Tue Oct 07 16:31:54 CEST 2014 .classpath

      [entry was signed on 9-10-14 12:19]
      X.509, [email protected], CN=codesigning 2014, OU=Test, O="Test BV ", L=Stad, ST=ZH, C=NL (codesign)
      [certificate is valid from 11-8-14 11:19 to 11-8-15 11:29]
      X.509, CN=CA-TEST (ca-test)
      [certificate is valid from 23-2-11 9:37 to 23-2-16 9:46]

smk      370 Tue Oct 07 16:31:54 CEST 2014 .project

      [entry was signed on 9-10-14 12:19]
      X.509, [email protected], CN=codesigning 2014, OU=Test, O="Test BV ", L=Stad, ST=ZH, C=NL (codesign)
      [certificate is valid from 11-8-14 11:19 to 11-8-15 11:29]
      X.509, CN=CA-TEST (ca-test)
      [certificate is valid from 23-2-11 9:37 to 23-2-16 9:46]

smk      792 Tue Oct 07 16:34:30 CEST 2014 nl/test/applet/TestApplet1.class

      [entry was signed on 9-10-14 12:19]
      X.509, [email protected], CN=codesigning 2014, OU=Test, O="Test BV ", L=Stad, ST=ZH, C=NL (codesign)
      [certificate is valid from 11-8-14 11:19 to 11-8-15 11:29]
      X.509, CN=CA-TEST (ca-test)
      [certificate is valid from 23-2-11 9:37 to 23-2-16 9:46]

           0 Tue Oct 07 16:33:50 CEST 2014 nl/
           0 Tue Oct 07 16:33:50 CEST 2014 nl/test/
           0 Tue Oct 07 16:33:50 CEST 2014 nl/test/applet/

  s = signature was verified 
  m = entry is listed in manifest
  k = at least one certificate was found in keystore
  i = at least one certificate was found in identity scope

jar verified.

I created a very basic html file with the tag:

<body>
    <p>Test page TestApplet1</p>

    <applet code="nl.test.applet.TestApplet1.class"
        archive="TestApplet1.jar"
        id="TestApplet1"
        height="0" width="0">
    </applet>

    <script type="text/javascript">
        alert(document.getElementById("TestApplet1").helloWorld());
    </script>
</body>

But when I deploy it on my test website and try to run the applet the applet is blocked by security settings. The message I get is: "Your security settings have blocked an untrusted application from running".

When I set the security level to "Medium", using the Java Control Panel, and then I open the webpage again I get the security warning: "An unsigned application from the location below is requested permission to run."

What is wrong with my approach?

By the way, I already imported my CA certificate to the trusted root CA's in both the IE certificate store and the certificates managed in the Java Control Panel.

Any suggestion is welcome.

rimas rimas · Accepted Answer · 2014-10-10T13:03:15

You need do following steps:

sign all jars by your key
make sure you using https.
if you using http or self signed ssl cert for https you need add you host into security exceptions list(jcontrol -> Security tab -> Edit Site list)

Signed java applet blocked by security setting

2 Answers