Home.... | log in.... | Pub my question! | Sign-up....
Java-index >> Security >> Signed Applets

Signed code runs using WebStart in 1.4 but not 1.5

I have a signed application that runs flawlessly under WebStart in 1.4 JDKs/JREs (on WinXP/2K, Linux and MacOS X) that refuses to run under WebStart in 1.5 JDKs (on both Windows and Linux; haven't tried on MacOS).

My code is packaged as an application, not an applet, but I haven't been able to find any info on what the problem might be, and I'm wondering if anyone has seen a similar problem with signed applets.

The error occurs when the certificate is validated (this is from 1.5.0_03):

java.security.cert.CeritificateException: Check leaf key usage failed in

certificate

at

com.sun.deploy.security.CertUtils.checkUsageForCodeSigning(CertUtils.java:102)

...

I've tried 1.5.0 (Windows & Linux) and 1.5.0_03 (Linux), with the same error each time. I know of several others who have also been unable to run my application under 1.5.0; I don't know of anyone who has been able to run it under 1.5.0.

I'm using a code-signing certificate bought from Thawte. I've tried using jarsigner from both 1.4 and 1.5, but get the same results each time. From the exception, it seems likely that 1.5.0 doesn't believe that the certificate used to sign the code can be used for code-signing, but I don't know why it would come to this conclusion.

I've successfully run this app using WebStart under 1.4.2_01, 1.4.2_03 and 1.4.2_06, on Linux and WinXP/2K (ie these JDKs all successfully validate the certificate used to sign the app and prompt the user as expected), plus various Apple 1.4 JVMs.

Google hasn't been of any assistance, so any help would be greatly appreciated.

Cheers,

Damian

[1676 byte] By [drdm7321a] at [2007-10-1 13:24:33]
«« What can I do to speed this up
»» which is the best and user freindly IDE for developing J2EE applications ?
# 1

It turns out that the flaw is me: for some reason, lost in the mists of

time, my keystore contains my SSL certificate, not my code-signing

certificate.

It might be useful to know that jarsigner (in both 1.4 and 1.5 SDKs)

will happily sign code with a certificate that is not suitable for that

purpose (such as an SSL certificate, which doesn't contain code-signing

extensions), and will also verify these signed jars. Similarly, it would

seem that the certificate verification procedures in WebStart that comes

with 1.4 JDKs also considers such jars as having been correctly signed.

WebStart in 1.5 clearly does additional checks :)

Damian

drdm7321a at 2007-7-10 16:18:46 > top of Java-index,Security,Signed Applets...
# 2
I have the same error, but i use NIO and y thought it was a java error, so if i use jarsigned under 1.5 it will run?I'll prove what you said. Thanks a lot!!
rcazalillaa at 2007-7-10 16:18:46 > top of Java-index,Security,Signed Applets...
# 3

The problem is not caused by jarsigner - the problem will occur regardless of whether you use jarsigner from 1.4 or 1.5. The problem is the certificate you're using. It's not a valid code-signing certificate. The reason you're having problems with 1.5 and not 1.4 is simply that 1.5 checks to see whether your code was signed by a code-signing certificate, and 1.4 doesn't do this check (or at least doesn't do it properly).

The solution is to obtain the right type of certificate, one that can be used for code-signing.

drdm7321a at 2007-7-10 16:18:46 > top of Java-index,Security,Signed Applets...
# 4
Excuse me, but how could i do this? i thought it was with keytools -keygen..... and then with jarsigner but it said it wasn't a valid certificate.thanks a lot for all !!
rcazalillaa at 2007-7-10 16:18:46 > top of Java-index,Security,Signed Applets...
Security
Signed Applets

Security New Topic

Security Hot Topic

Security

All Classified