Here's a complete example

This worked with Win98 + JDK1.3.1 + IE5.00 all installed to default locations. Notes follow.

************************************************************

************************ test.bat ************************

************************************************************

REM *** delete any existing key called "mykey" in the java plugin "cacerts" file

keytool -delete -alias mykey -keystore "C:\Program Files\JavaSoft\JRE\1.3.1\lib\security/cacerts" -storepass changeit

REM *** compile the applet and stick it in a jar

javac HelloApplet.java

jar cvf hello.jar HelloApplet.class

REM *** delete default keystore if already present - we don't know the password

del c:\windows\.keystore

REM *** generate a keypair in the default c:\windows\.keystore

keytool -genkey -alias mykey -keypass password -dname "cn=test" -storepass password

REM *** use the new key to make a signed jar

jarsigner -signedjar hellosigned.jar -storepass password hello.jar mykey

REM *** export the key to a certificate file

keytool -export -alias mykey -file mykey.cer -storepass password

REM *** import the key to the cacerts file used by the plugin

keytool -import -file mykey.cer -keystore "C:\Program Files\JavaSoft\JRE\1.3.1\lib\security/cacerts" -storepass changeit

REM *** make sure we use class file out of jar file

del HelloApplet.class

************************************************************

********************hello.html************************

************************************************************

<HTML><BODY>

<OBJECT classid="clsid:CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA"

codebase="http://java.sun.com/products/plugin/1.3.1/jinstall-131-win32.cab#Version=1,3,1,0">

<PARAM NAME = CODE VALUE = HelloApplet >

<PARAM NAME = ARCHIVE VALUE ="hellosigned.jar" >

<PARAM NAME="type" VALUE="application/x-java-applet;jpi-version=1.3.1">

</OBJECT>

</BODY></HTML>

************************************************************

*****************HelloApplet.java*********************

************************************************************

import java.io.*;

import java.applet.*;

public class HelloApplet extends Applet

{

public void init()

{

try {

FileWriter fileout = new FileWriter("hello.txt");// create a new file

fileout.write("Hello");// put some text in the file

fileout.close();

} catch (Exception e) { e.printStackTrace(); }

}

}

************************************************************

NOTES:

Open the html file in your browser and you should get a dialog asking if you want to install and run the applet.

Check the "duke" icon in your taskbar for errors (not browsers java console).

The output file "hello.txt" defaults to location "c:\windows\desktop".

Read the documentation on keytool, jarsigner, and htmlconverter to find out how to get your own code working.

classid and version info in the HTML will vary with the JRE version. Does this lead to compatibility problems?

Bug? The above example only works if the key is called "mykey". If the .bat file is changed to "testkey" the applet fails because the key imported into the "cacerts" file will always be called "mykey", and to get rid of it you must use "keytool -delete -alias mykey ..."

Odd? When the applet is recompiled, the only way to reload the applet is to quit and restart the browser.

Bug? Running jarsigner from the batch file, it appears to hang, but works after hotkey out of the DOS window and back into it.

-Paul

[3804 byte] By [pweb] at [2007-9-26 3:01:57]
# 1
Hi!It's wonderfool, THANK YOU, THANK YOU,THANK YOU.Bye.
esthermi at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 2

If interested in an appli that helps in signing process, you may download XLRSecTool for

free at:

. Windows:

http://www.xlreader.com/download/stl10ea/InstData/Windows/NoVM/istl10ea.exe

. Unix and Linux:

http://www.xlreader.com/download/stl10ea/InstData/Unix/Others/istl10ea.bin

. Other Java-enabled OS

http://www.xlreader.com/download/stl10ea/InstData/Java/install.zip

Requires Java VM 1.3.1

-- Robert

=====

robert@xlreader.com

XL-Reader Project - Secured online documentation solutions

www.xlreader.com

=====

robdella at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 3

Hi, Ive tried the example and I keep getting errors when i run the batch file. heres the first one as it appears in the dos window:

C:\JAVAPR~1\CLIENT>keytool -genkey -alias mykey -keypass password -dname "cn=tes

t" -storepass password

keytool error: java.io.IOException: Keystore was tampered with, or password was

incorrect

Then I keep getting the same error while the rest of the commands are executed.

Id really appreciate any help,

Jim

jmor1 at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 4

Thank u very very very much.

The com.ms.security.securiyExceptionEx() was killed ok.

But i meet a new problem that if i using <applet> tag.

I can call the java method in javascript code. But when i using ur way , It always show the error that the object not support this attribute. How can make javascript can call applet method in <object> tag.

Thx very much again.

Bob

Bob_lee at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 5

I am sorry, i found another problem again now.

The signed applet can well run in my computer because i run the bat file . that is , in jre, the cer key is imported . But when i place the applet in internet, how import my cer key to client jre. Now when i run the applet , the java console always said:

java.security.cert.CertificateException:Unable to verify the certificate with root CA.

How can i do.

Thx

Bob

Bob_lee at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 6

If at all possible switch to using the new JRE (1.3.1-01a), this has MUCH better applet signing support and you no longer have to manually import the .cer file on the client. It uses the standard keytool and jarsigner technique and because it is the plugin that handles all the validation it works fine on both Netscape and IE. In short, it is the way Sun should have done it in the first place, and as an added bonus it gets all your clients running with a consistent VM.

Rob

vampire1 at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 7
Thx. But i still make my applet well work in internet.Any work sample.How make my applet which was signed in my computer can run in internet client. thx again.Bob
Bob_lee at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 8
Sorry, I make a mistake in the above thread . Instead , I still can`t make my applet which was signed in my pc well work in internet.sorry.Bob
Bob_lee at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 9

I would like to use the new JRE 1.3.1_01a, but I want to know where do we get codebase and classid I am trying to use :

<HTML><BODY>

<OBJECT classid="clsid:CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA"

codebase=="http://java.sun.com/products/plugin/autodl/jinstall-1_3_1_01a-win.cab#version=1,3,1,1">

<PARAM NAME = CODE VALUE = HelloApplet >

<PARAM NAME = ARCHIVE VALUE ="hellosigned.jar" >

<PARAM NAME="type" VALUE="application/x-java-applet;jpi-version=1.3.1">

</OBJECT>

</BODY></HTML>

but no luck.

hemant_gadiya at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...
# 10

Thats the beauty of 1.3.1_01a, you can ditch all the object stuff (and the html converter) and just use straight applet tags, have a look on the plugins page for how to do it - all you need to do is include some javascript in the html head that forces the browser to check whether or not the plugin is installed - if not it automatically downloads it (for IE anyway). Nearly seamless at last :-) As I said anyway, check the sun plugin page, look in the developer/web master support section.

Rob

vampire1 at 2007-6-29 11:00:31 > top of Java-index,Security,Signed Applets...