Cerficate Vs Policy File

Hello Friends
I have signed jar with a certificate exported. Now when another user from some other machine runs tries to invoke the html(which contains the applet) from my server they get a certificate request poping up asking whether you what the certificate to be downloaded?
They accept yes and the applet runs. so what about policy file which i created to give to the client to make him give access to my applet.
So how in real terms how will policy file gets distributed with the certicate?

Please help

Thanks
Farouk

Policies and certificates are two complimentary, but unrelated, ways to assign trust to an applet. If you use one, you don't need the other. Policies can be finer-grained (certificates are an all-or-nothing thing), but require the user to change obscure settings on their machine, while the certificate dialog is generally understood. Some more pointers can be found on this page.
[ January 27, 2006: Message edited by: Ulf Dittmer ]

Thanks Ulf
So basically what your saying is if you use policy files there is no need to use certificates and if you use certificates you cannot use policy files.
Usign certificates exposes the whole client environment to the applet. Using policy files grant requred access only.

So if my understanding right.
1. If i have to use policy file, I have to still sign the jar and provide a certificate with the jar where in the applet is present?
Please reply.
2. How will you distribute your policy file when you have to use security using policy files.

Regards
Farouk

if you use certificates you cannot use policy files

You can use both together. But there's no point in doing so.

If i have to use policy file, I have to still sign the jar and provide a certificate with the jar where in the applet is present?

No. Like I said, they're independent of each other.

How will you distribute your policy file when you have to use security using policy files

Maybe email instructions to your users with what to do? Or put those instructions on the web page that hosts the applet? You shouldn't distribute an actual file, because users might have one already, and you don't want them to replace that by yours.