Self Signing and Applets

Question

I have spent hours reading over the Signed Applets forum and Sun applet security training pages. There seems to be so much confusion in this area that the use and proliferation of Java Applets must be suffering.
As the usual underfunded developer, I am not able to buy a certificate before proving the concept. Therefore, I am relegated to using self signed applets to demonstrate the use of signed applets and the power they have. This would also be the case for students of Java applets, of which I am also one.
I have tried the sample applets in the Sun security training. They in fact write the file to my system, but they also display a security error as well.
The Sun training indicates that I should be using a policy file with the security and that when my applet is run by another user, that user must also manually update their policy file, using keytool, before running the applet. If this is true, I see no use for Java Applets that work outside of the sandbox confines. There must be a better way to use applets that require security.
I have also read Irene's 10 steps and numerous comments about them. They seem to work fine until I get to step 10. If I am using a self signed applet, why should the user of the applet have to click on a HREF to load the certificate into the keystore? Why shouldn't the user be prompted to trust the self signed certificate, just like a certificate obtained from a CA?
I have tried to develop a batch file (Windows NT 4.0) to illustrate the signing process, but I have been unsuccessful. I have listed the output from it below followed by the batch file itself. Would someone please indicate what would make this batch file work? If possible, I would like it to work for both IE 5.5 and Netscape 4.06; especially ie 5.5.
My environment consists of:
NT 4.0 (SP6)
IE 5.5 (SP1)
JRUN 3.1
JRE 1.3.1_01
JDK 1.3.1_01
javac writeFile.java
keytool -delete -alias writefile
Enter keystore password: password
keytool -genkey -alias writefile
Enter keystore password: password
What is your first and last name?
[Unknown]: Robert Klawuhn
What is the name of your organizational unit?
[Unknown]: mygroup
What is the name of your organization?
[Unknown]: mycompany
What is the name of your City or Locality?
[Unknown]: mycity
What is the name of your State or Province?
[Unknown]: mystate
What is the two-letter country code for this unit?
[Unknown]: US
Is <CN=Robert Klawuhn, OU=mygroup, O=mycompany, L=mycity, ST=mystate, C=US> correct?
[no]: yes
Enter key password for <writefile>
(RETURN if same as keystore password): password
keytool -selfcert -alias writefile
Enter keystore password: password
keytool -list -alias writefile
Enter keystore password: password
writefile, Wed Dec 19 10:41:35 PST 2001, keyEntry,
Certificate fingerprint (MD5): 90:4D:63:0E:9E:56:CF:7F:93:2B:92:EE:AA:2B:87:E3
jar cvf writefile.jar writeFile.class
added manifest
adding: writeFile.class(in = 1678) (out= 940)(deflated 43%)
jar tvf writefile.jar
0 Wed Dec 19 10:41:58 PST 2001 META-INF/
71 Wed Dec 19 10:41:58 PST 2001 META-INF/MANIFEST.MF
1678 Wed Dec 19 10:40:46 PST 2001 writeFile.class
jarsigner writefile.jar writefile
Enter Passphrase for keystore: password
jarsigner -verify -verbose -certs writefile.jar
139 Wed Dec 19 10:42:02 PST 2001 META-INF/MANIFEST.MF
192 Wed Dec 19 10:42:08 PST 2001 META-INF/WRITEFIL.SF
1098 Wed Dec 19 10:42:08 PST 2001 META-INF/WRITEFIL.DSA
0 Wed Dec 19 10:41:58 PST 2001 META-INF/
smk 1678 Wed Dec 19 10:40:46 PST 2001 writeFile.class
X.509, CN=Robert Klawuhn, OU=mygroup, O=mycompany, L=mycity, ST=mystate, C=US (writefile)
s = signature was verified
m = entry is listed in manifest
k = at least one certificate was found in keystore
i = at least one certificate was found in identity scope
jar verified.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
An error appears:
java.security.cert.CertificateException: Unable to verify the certificate with root CA
@ECHO OFF
REM Doit.bat
REM
REM This batch file leads the user through the creating
REM and signing of an applet class and how it is accessed
REM from a browser. The applet creates the file: C:\tmpfoo.
REM
REM The JRE 1.3.1 plug-in should be installed. See the
REM control panel for an icon leading to the plug-in.
REM
REM This demo is for JRE 1.3.1_01, NT 4 (SP6), HTMLConverter
REM 1.3, and IE 5.5.
REM
REM Run the HTMLConverter 1.3 against the following HTML
REM file to generate the converted HTML that will support
REM both Netscape and IE. Get the converter from Sun.
REM
REM <html>
REM <head>
REM <title> Java Security Example: Writing Files</title>
REM </head>
REM <body>
REM Hi there. There is a signed applet following...
REM <hr>
REM <applet code=writeFile.class archive="/writefile.jar" width=500 height=50>
REM </applet>
REM <hr>
REM </body>
REM </html>
REM
REM The following is the code for the applet.
REM
REM import java.awt.*;
REM import java.io.*;
REM import java.lang.*;
REM import java.applet.*;
REM
REM public class writeFile extends Applet {
REM String myFile = "/tmp/foo";
REM File f = new File(myFile);
REM DataOutputStream dos;
REM
REM public void init() {
REM
REM String osname = System.getProperty("os.name");
REM if (osname.indexOf("Windows") != -1) {
REM myFile="C:" + File.separator + "tmpfoo";
REM }
REM }
REM
REM public void paint(Graphics g) {
REM      try {
REM      dos = new DataOutputStream(new BufferedOutputStream(new FileOutputStream(myFile),128));
REM      dos.writeChars("Cats can hypnotize you when you least expect it\n");
REM      dos.flush();
REM      g.drawString("Successfully wrote to the file named " + myFile + " -- go take a look at REM it!", 10, 10);
REM      } catch (SecurityException e) {
REM      g.drawString("writeFile: caught security exception", 10, 10);
REM } catch (IOException ioe) {
REM      g.drawString("writeFile: caught i/o exception", 10, 10);
REM }
REM }
REM }
REM
@ECHO javac writeFile.java
javac writeFile.java
REM Generate a selfsigned certificate and put it into
REM the keystore.
REM
REM password = password
REM first and last name = Robert Klawuhn
REM org unit = COMPASS
REM org = Applied Materials
REM city = Santa Clara
REM state = California
REM country = US
REM The -selfcert option may not be necessary the first
REM time this is run
@ECHO keytool -delete -alias writefile
keytool -delete -alias writefile
@ECHO keytool -genkey -alias writefile
keytool -genkey -alias writefile
@ECHO keytool -selfcert -alias writefile
keytool -selfcert -alias writefile
REM
REM Export the key that was just created into a .crt file.
REM This is then sent to a CA to obtain a 'real' certificate
REM which is then imported into the keystore. These are
REM commented because I am trying to use a self-issued key.
REM
REM keytool -certreq -alias writefile -file writefile.crt
REM keytool -import -alias writefile -file writefile.crt
@ECHO keytool -list -alias writefile
keytool -list -alias writefile
REM Jar the applet
REM
@ECHO jar cvf writefile.jar writeFile.class
jar cvf writefile.jar writeFile.class
REM Verify the jar
REM
@ECHO jar tvf writefile.jar
jar tvf writefile.jar
REM Sign the jar
REM
REM passphrase = password
@ECHO jarsigner writefile.jar writefile
jarsigner writefile.jar writefile
REM Verify the signed jar file
REM
@ECHO jarsigner -verify -verbose -certs writefile.jar
jarsigner -verify -verbose -certs writefile.jar
REM The next statements assume that the applet will be
REM obtained from Macromedia's JRun default server.
REM
copy writefile.crt %JRUN_HOME%\servers\default\default-app\.
copy writefile.jar %JRUN_HOME%\servers\default\default-app\.
copy writefile.html %JRUN_HOME%\servers\default\default-app\.
"C:\Program Files\Plus!\Microsoft Internet\IEXPLORE.EXE" "http://localhost:8100/writefile.html"

Answer 1

I believe I finally found my problem. If I use JRun as a web server and put the applet on the default server within JRun, I am only able to run the applet from a different client. It doesn't seem to load right on the same system as JRun.
This may be due to other software I have running on my JRun server system, but it finally works.
For those that are still having problems with self-signing applets, here is a batch file, that I am using, that works for me.
@ECHO OFF
REM Doit.bat
REM
REM This batch file leads the user through the creating
REM and signing of an applet class and how it is accessed
REM from a browser. When the Publish button is pressed
REM     the selected file is copied to C:\TEMP\BOBK_copy.txt.
REM
REM The JRE 1.3.1 plug-in will be installed on the client.
REM See the control panel for an icon leading to the plug-in.
REM
REM This demo is for JRE 1.3.1_01, HTMLConverter
REM 1.3, and IE 5.5.
REM
REM Run the HTMLConverter 1.3 against the following HTML
REM file to generate the converted HTML that will support
REM both Netscape and IE. Get the converter from Sun.
REM
REM <html>
REM <head>
REM <title> Java Security Example</title>
REM </head>
REM <body>
REM Hi there. There is a signed applet following...
REM <hr>
REM <applet code=FilePrompt.class archive="/fileprompt.jar" width=800 height=500>
REM </applet>
REM <hr>
REM </body>
REM </html>
REM
REM This applet can be executed by starting the default server in JRun and then
REM then entering the following for the IE URL: http://K011614:8100/FilePrompt.html
REM This assumes that JRun is installed and running on K011614.
REM
REM The first time the applet is executed, the 1.3.1_02 JRE is loaded if allowed.
REM The main problem here is the JRE is about 5.3MB and takes a while.
REM
REM For some reason, running IE and pointing it to the applet on the same system that
REM JRun is executing, doesn't work. You have to run it from another client that
REM references the applet.
REM
@ECHO keytool -delete -alias fileprompt
keytool -delete -alias fileprompt
@ECHO keytool -genkey -alias fileprompt
keytool -genkey -alias fileprompt
@ECHO keytool -selfcert -alias fileprompt
keytool -selfcert -alias fileprompt
@ECHO keytool -export -alias fileprompt -file fileprompt.crt
keytool -export -alias fileprompt -file fileprompt.crt
@ECHO keytool -list -alias fileprompt
keytool -list -alias fileprompt
@ECHO jar cvf fileprompt.jar *.class
jar cvf fileprompt.jar *.class
@ECHO jar tvf fileprompt.jar
jar tvf fileprompt.jar
@ECHO jarsigner fileprompt.jar fileprompt
jarsigner fileprompt.jar fileprompt
@ECHO jarsigner -verify -verbose -certs fileprompt.jar
jarsigner -verify -verbose -certs fileprompt.jar
copy fileprompt.jar %JRUN_HOME%\servers\default\default-app\.
copy FilePrompt.html %JRUN_HOME%\servers\default\default-app\.
REM The following doesn't seem to work when executed on the same
REM system as the JRun server. Access the applet from another client.
REM "C:\Program Files\Plus!\Microsoft Internet\IEXPLORE.EXE" "http://localhost:8100/FilePrompt.html"
pause