How to install an applet on a Security Domain

Question

Dear all,
I have installed a new SD on my card but I cant install my applet on it! I dont know what is the problem and I havent found any related reference! I was wondering that maybe I am doing sth wrong with my SD and applet installation, here is what I have done:
1.Select ISD
2.Authenticate with ISD keys
3.Install a new instance of ISD with Security Domain privilege
4.Select new SD
5.Authenticate with default keys
6.Put key command
7.Authenticate with new keys
8.install for load my applet ----> (6A86) failed!
Thanks for your helps!

Answer 1

that means associating an application (applet instance) with another security domain than the ISD.
an SSD is basically a keystore application, even if its aid can be selected to open a secure channel with the keys it contains.
The main use is to make GPSystem.getSecureChannel() refer to the other (SSD) keys. This way, a card owner can install an applet and delegate secure channel services to the SSD, using dedicated keys.
You can also open a secure channel with the SSD (using its own keys) and use INSTALL FOR PERSONNALIZATION / STORE DATA.
this way you don't have to give the ISD keys to a applet provider for him to be able to personnalize its own applet.
the owner of the ISD keys manages the card contents (install for install / delete) and the applet provider manages the personnalization.
Note that normal SSD are able to manage channels, but generally are not allowed to load/install/delete applets.
DAP requires the applet owner to sign its CAP file and to verify the signature on the card. the card manager loads the cap, the signature ensures the CAP file provided by the applet provider was not tampered.
with DM, the applet provider runs the card management commands, but the card requires these commands to be signed by the card manager. The card manager can choose which commands are allowed.