File read access denied for signed applet

Question

Hi:
I have a signed applet with a certificate generated with the keytool. Yet, I keep getting this error:
java.lang.Exception: java.security.AccessControlException:
    access denied (java.io.FilePermission C:\WINDOWS\system32\aetpkss1.dll read)The error is produced when the method loadKeyStore(pin) below is called.
    private KeyStore ks;
    private Provider provider;
    private static final String providerName    = "PKCS11";
    private static final String providerLibrary = "aetpkss1.dll";
    public void loadKeyStore(String pin) throws IOException,
     CertificateException, KeyStoreException, NoSuchAlgorithmException {
     if (provider == null)
         registerProvider(providerLibrary);
     try {
         ks = KeyStore.getInstance(providerName,provider);
     } catch (Exception e) {
         throw new KeyStoreException("Failed get keystore instance\n"
                         + e.getMessage());
     try {
         ks.load(null, pin.toCharArray());
     } catch (Exception e) {
         throw new KeyStoreException("Failed load keystore\n"
                         + e.getMessage());
    public void registerProvider(String library)
     throws FileNotFoundException, KeyStoreException {
     String fileName;
     if (new File(library).isAbsolute())
         fileName = library;
     else
         fileName = getAbsolutePath(library);
     if (!(new File(fileName).exists()))
         throw new FileNotFoundException("No such file: " + fileName);
     String config = "name = " + providerName + "\n"
         + "library = " + fileName;
     ByteArrayInputStream confStream =
         new ByteArrayInputStream(config.getBytes());
     try {
         provider = new sun.security.pkcs11.SunPKCS11(confStream);
         Security.addProvider(provider);
     } catch (Exception e) {
         throw new KeyStoreException("Can initialize " +
                         "Sun PKCS#11 provider. Reason: " +
                         e.getCause().getMessage());
    private String getAbsolutePath(String lib) throws FileNotFoundException {
     String[] searchPath;
     /* NOTE: This should be modified to suit different versions of   *
      *       Windows and not just Windows XP                         */
     if (System.getProperty("os.name").matches("^(?i)Windows.*")) {
         searchPath = new String[] { "C:\\WINDOWS\\system32" ,
                         "C:\\java" };
     } else {
         searchPath = new String[] { "/usr/local/lib/" };
     for (int i = 0; i < searchPath.length; i++) {
         if ((new File(searchPath[i] + File.separator + lib).exists()))
          return (searchPath[i] + File.separator + lib);
     throw new FileNotFoundException("Library not in search path " + lib);
    }The above code is called by a java script, the class' constructor is empty.
The error appears not to be caught by my code. I have tried to insert try/catch statements everywhere to figure out where this error is produced.
The code is write off of the applet for signing with a smart card by Svetlin Nakov - and his applet works!
I have also made a CLI application that uses the above code and it works perfectly.
So: Something is wrong either with my certificate, the signing method, signature verification or something completely different. Any hints?
The certificate I generated with
keytool -genkey -keystore mystore -alias me
keytool -seflcert -keystore mystore -alias meI have tired both with and without the selfcert step.
Thanks! Erik

Answer 1

The problem has been identified: Placing registerProvider() in the constructor the error no longer occurs, instead an error is produced when the key store is loaded.
It appears that the javascript code is not trusted and so, even though the applet is signed, access privileges are restricted to those of the java script.
A solution to this problem is not clear, but possibly, serving the pages from a trusted server, the java script will be trusted, some documentation seem to indicate.