Success: how to self-sign an applet

I created a simple Java applet. I jar'd it creating hw.jar and got it to work in a web page with an applet tag. I did all this on my PC and verified it using Firefox and IE7.

Next I added code in the applet to reference the local file system. This failed as expected, the Java console showing:

Exception in thread "AWT-EventQueue-2" java.security.AccessControlException: access denied (java.util.PropertyPermission user.dir read)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
at java.lang.System.getProperty(Unknown Source)
at java.io.Win32FileSystem.getUserPath(Unknown Source)
at java.io.Win32FileSystem.resolve(Unknown Source)
at java.io.File.getAbsolutePath(Unknown Source)
at com.sbqsam.test.applets.HelloWorld$3.actionPerformed(HelloWorld.java:74)

So now I'm ready to sign the applet and see this error go away. I want to use a certificate that I generate myself; during development I don't want to have to pay to get a real certificate. Here are the exact steps that worked for me (Windows XP, sp 3):

-->keytool -genkey -keyalg rsa -alias sbqsam0
Enter keystore password: *****
Re-enter new password: *****
...
Enter key password for <sbqsam0>
(RETURN if same as keystore password): *****

-->keytool -export -alias sbqsam0 -file sbqsamCert.crt
Enter keystore password:
Certificate stored in file <sbqsamCert.crt>

-- I get an error doing this step:

-->jarsigner hw.jar sbqsamCert
Enter Passphrase for keystore:
jarsigner: Certificate chain not found for: sbqsamCert. sbqsamCert must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

-->keytool -list
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

-- Here's the critical step, provided by hyeomer's post of Sep 26, 2003 4:49AM
-- on this forum: http://forums.sun.com/thread.jspa?threadID=433828&tstart=960

-->keytool -export -alias sbqsam0 -rfc -file sig.x509
Enter keystore password:
Certificate stored in file <sig.x509>

-->jarsigner hw.jar sbqsam0
Enter Passphrase for keystore:

Warning:
The signer certificate will expire within six months.

When I display that directory there are only these three files:

03/22/2009 12:46 PM 6,062 hw.jar
03/22/2009 10:18 AM 627 sbqsamCert.crt
03/22/2009 12:16 PM 914 sig.x509

My next step is to move all this up to my web site. I'm hoping if I move these three files into the folder that contains the .html file with the <applet> tag which references hw.jar that it will all work.

-Sam

Great! How did it go in the server?

Sorry for not following up. It worked for me.

-Sam

my jar file which has the applet class files and image files is not able to load it. i have no idea why.. I have signed the jar file and all but it doesnt work ? any idea why ?

Titus Abraham wrote:my jar file which has the applet class files and image files is not able to load it. i have no idea why.. I have signed the jar file and all but it doesnt work ? any idea why ?

Hi, are you doing this on a web application?

Does it work if you dont sign the jar?

What error are you getting (what does 'not able to load it' mean)?

Samuel Quiring wrote:Sorry for not following up. It worked for me.

-Sam

It also worked for me. I just followed what you did.

Have you figured out how to 'import' a saved one into the default keystore (opposite of 'export')?

I tried but I am getting the error below:

C:\signjar>keytool -export -alias ABCKey  -file ABCKey.crt
Enter keystore password:
Certificate stored in file <ABCKey.crt>

C:\signjar>keytool -delete -alias ABCKey
Enter keystore password:

C:\signjar>keytool -import -rfc -file ABCKey.crt -alias ABCKey
Enter keystore password:
Owner: CN=ABC, OU=ABC, O=ABC, L=singapore, ST=singapore, C=SG
Issuer: CN=ABC, OU=ABC, O=ABC, L=singapore, ST=singapore, C=SG
Serial number: 4a2c92b1
Valid from: Mon Jun 08 12:25:21 SGT 2009 until: Sun Sep 06 12:25:21 SGT 2009
Certificate fingerprints:
         MD5:  D7:1B:24:8C:2C:88:3D:D4:8D:C3:63:CD:08:FC:85:80
         SHA1: 5D:BF:D2:83:22:EF:14:17:93:79:31:F2:59:95:E7:EF:B3:06:C5:29
         Signature algorithm name: SHA1withRSA
         Version: 3
Trust this certificate? [no]:  y
Certificate was added to keystore

C:\signjar>jarsigner myApplet.jar ABCKey
Enter Passphrase for keystore:
jarsigner: Certificate chain not found for: ABCKey.  ABCKey must reference a val
id KeyStore key entry containing a private key and corresponding public key cert
ificate chain.

Hey... i was using a relative path. and relative paths do not work in applets. thats why i was getting error. thanks for the help.