Applet Security over Network

Question

Hi, I have an Applet that requires access to the system clipboard of the client. I have never had to sign an applet before, and wanted to know if I need to have a Verisign certificate or equivalent in order to distribute this over network where I work.
The network uses NT authentication so is already secured and trusted, do I really need to go to the expense of getting a certificate just to be able to a small number of staff to use an applet at work? Or is there another way?
Many thanks in advance
AMD

Answer 1

Though there is already a 10 step approach for signing applets, I'll try to explain how you can sign an applet with a self signed certificate (free) and be able to manage your applet on your server so clients do not need to have a policy file on there computer. The only disadvantage of this approach is that a self signed certificate expires after one year, but since you can update your certificate on the server this should not be a big problem.
create your keystore with keypair:
keytool -genkey -keystore your_company.store -alias programmer_name
fill in the information for name company etc.
export the certificate from the store:
keytool -export -keystore your_company.store -alias programmer_name -file certificate_name.cert
Make a JAR file for your classes:
jar cvf your_applet.jar *.class
and sign your JAR file
jarsigner -keystore your_conpany.store your_applet.jar certificate_name
I always keep my certificates in another store. To this:
keytool -import -keystore all_your_certificates.store -alias programmer_name -file certificate_name.cert
Now you have got a signed applet. To post this on a server do this:
Inside the policy file you can specify the keystore location:
keystore "http://intranet.mysoft.com/admin/all_your_certificates.store", "JKS";
grant signedBy "programmer_name"
{permission java.awt.AWTPermission "accessClipboard";
permission java.awt.AWTPermission "createRobot";
permission java.awt.AWTPermission  "readDisplayPixels";
Place the all_your_certificates.store and policy file on the intranet server.
The advantage of this way of working is everything can be managed remotely. As you can see, the applets that are signed by the certificate have permission for accessing the clipboard. You can specify different security settings for each certificate in the policy file.
Every visiter can now access your applet without needing the certificate installed because it can be found on the server.