Signing applets for a period

hi all..
I have an applet in my web site and it needs to access some system resources.
I have signed it and it's working properly. But by default, is it valid for six months only? how can I sign an applet with a certificate which will be valid for ever or till a specified time period?
I used jarsigner tool. is there any parameter that I can specify with this for a specifying time period
plz help me
thanx and regards
sand...

sanpops wrote:
hi all..
I have an applet in my web site and it needs to access some system resources.
I have signed it and it's working properly. But by default, is it valid for six months only? how can I sign an applet with a certificate which will be valid for ever or till a specified time period?
I used jarsigner tool. is there any parameter that I can specify with this for a specifying time period
plz help me
thanx and regards
sand...The fact that the certificate expired means it cannot be used for signing anymore. The applet will still run,
if the user reads carefully the message and allows it to run. If you click more info in the security dialog,
you will see that it says "the applet was signed with a valid certificate". I have to admit that I am not
comfortable with this answer and I blame Sun for a wrong (or paranoid) implementation of this security
dialog. Contrast it with the Microsoft dialog for ActiveX controls, which is correct, IMHO. There should be
nothing scarry if the signatured used a valid certificate and it was done 10 years ago. The certificate
confirms the identity of the applet creator and the fact that the applet was not tempered with since creation.
If the creator was honorable in 1997 and now he is in jail it does not matter at all, since I am running an
applet created when he was a good citizen.
Another problem with this dialog is that I sell a product that contains signed applets. My one year Verisign certificate expires and the clients start asking questions that I can answer only in one of two ways:
- Blame Sun as above
- Redo an otherwise unnecessary build and send it to them, which does not make them very happy either,
as nobody like to upgrade something that works just fine.

Similar Messages

Problems with signed Applet for File Download under JRE 1.4 (works with 1.3

Dear all,
i encountered a very strange behaviour with JRE 1.4x. A signed applet used for file download worked on all platforms (Windows NT, 2000 and XP wth/wthout SP...) until I installed JRE 1.4.x (1.4.1 or 1.4.2)
I get an EOFException when downloading binary files (for ASCII it works fine) when trying to readByte() from a DataInputStream. But not immideately, but after x bytes in the while-loop. Security is fine (I know there have been changes to that in jre 1.4, the applet itself can be started an runs with ASCII files for transfer)
Does anyone know, what has changed in jre1.4.
As I said, it works fine under jre 1.3.x
The relevant code is below: byte bt = dis.readByte(); causes the error
try{
// Get URL from Server
URL uFile = new URL(sFilename);
sThisURLFile = uFile.getFile();
Integer inte = new Integer(i);
//open input stream for the file on server
DataInputStream dis = new DataInputStream(new BufferedInputStream
(uFile.openConnection().getInputStream()));
//open output stream for the file on local drive
String sFilenameOnly = sThisURLFile.substring(sThisURLFile.lastIndexOf('/')+1);
int iDotPos = sFilenameOnly.lastIndexOf(".");
String sExt;
if (iDotPos > 0) {
sExt= sFilenameOnly.substring(iDotPos);
} else {
sExt = "";
File fileOut = new File(sDownloadDir + sThisURLFile.substring(sThisURLFile.lastIndexOf('/')+1) );
DataOutputStream dos = new DataOutputStream(new
BufferedOutputStream(new FileOutputStream(fileOut)));
//read one byte from input stream, and write that byte to output stream
long nByte = 0;
int iCnt = 0;
iFilesizeDone ++;
while (nByte < iFilesize){
String sErrPs = new String();
try{
sErrPs = "00";
byte bt = dis.readByte();
sErrPs = "01";
dos.writeByte(bt);
} catch (EOFException ee)
System.err.println("internal EOFException: " + ee.getMessage());
System.out.println("Error Filesize is " nByte " of " iFilesize "---" + sErrPs);
break;
nByte++;
iFilesizeDone ++;
iCnt ++;
if(iCnt >= 10240) {
ShowProgress(nByte, iFilesize, iFilesizeDone, iFilesizeTotal); // repaint does not work during init-procedure
iCnt = 0;
line = "Progress: Total: " + ((iFilesizeDone*100)/iFilesizeTotal) + " perc, " + iFilesizeTotal/1024 +" kbytes" ;
labLine.setText(line);
//dos.flush(); // improves Client performance (Agent-Call!)
dis.close();
dos.close();
}// End try
catch (EOFException ee)
System.err.println("EOFException: " + ee.getMessage()e);
catch (SecurityException se)
System.err.println("SecurityException: " + se.getMessage());
catch (IOException ioe)
System.err.println("IOException: " + ioe.getMessage());

perhaps they've changed something with the file blocking.
btw, you should try to use something like this
DataInputStream dis = new DataInputStream(is);
byte[] buffer=new byte[8192];
int numBytesRead;
while ( dis.available()>0 ) {
numBytesRead = dis.read(buffer);
}

6 Step Signed Applet for IE

last week I have the problem for Signed Applet,
and I hope this will Help You.
but, I am sorry
for Netscape, it's not done yet.
So, here are the Step for IE
1. Create you java code (takepic.java)
     in your code write the securiy permission
     if(Class.forName("com.ms.security.PolicyEngine") != null)
mlabel.setText("Done IE");
PolicyEngine.assertPermission(PermissionID.UI);
     write your permission you want at the PermissionID target
2. Create Cab File
     cabarc -p -r -s 6144 N takepic.cab takepic.class
3. Create certificate
     makecert -sk private -n "cn=I Gusti Putu Anom" anom.cer
4.create spc from certificate
     cert2spc anom.cer anom.spc
5. create ini file contains permission you want (example perms.ini)
     [com.ms.security.permissions.PrintingPermission]
     [com.ms.security.permissions.PropertyPermission]
     Unrestricted=false
     IncludedProperties=java.vendor
     [com.ms.security.permissions.ThreadPermission]
     AllThreadGroups=true
     AllThreads=true
     [com.ms.security.permissions.UIPermission]
     ClipboardAccess=true
     TopLevelWindows=true
     NoWarningBanners=true
     FileDialogs=true
     EventQueueAccess=true
6. signcode -j javasign.dll -jp perms.ini -spc anom.spc -k private takepic.cab
for Netscape, you must use PrivilegeManager and you must create a jar file
     if(Class.forName("netscape.security.PrivilegeManager") != null)
PrivilegeManager.enablePrivilege("SuperUser");
you can find package for netscape at C:\Program Files\Netscape\Communicator\Program\java\classes\java40.jar
for IE, you can find it at C:\WINNT\java\Packages\GI53BPN9.zip
you can find the article at :
http://www.ddj.com/articles/1999/9902/9902h/9902h.htm
regards,
I Gusti Putu Anom A
Software Engineer
Balicamp
Bali - Indonesia

I used the file from C:\WINNT\java\Packages\ folder.
I used GI53BPN9.zip (My OS is Windows 2000)
there are 8 files on this folders
Windows 2000 and Windows NT has diferrent name for the package file.
I think you should use all the zip file from "C:\WINNT\java\Packages\", Because I'm not sure which file contain com.ms.security on your computer.

Signed applet for file download?

Hello folks,
I have a signed applet through which i can upload multiple files to a servlet. I wish to create another applet or enhance this one to enable it to download multiple files from the server to the client m/c. Any idea, how to go about it?
I will appreciate your helpful replies.
Thank you,
Coreli

which part? You apparently already know how to sign an applet... and use a file chooser... and create servlets that can take files.... seems you need to do the opposite and use input streams where you used output streams before and vice versa...

Help! -- Safari, etc. crash when I verify a signed Applet for Party Poker

I need help.
I am trying to make an Applet run from the Party Poker website.
Every time I try to verify the certificate, Safari, Firefox, and Camino browsers "quit unexpectedly". I have submitted numerous reports, but nothing has been resolved.
Can someone please tell me what I can do.
Thanks.

Thanks Starman.
I'm providing the crash report. The applet did work on the Party Poker site for awhile and then it just started crashing. I contacted the site as you suggested and provided them the report as well. Thanks. If you see anything noteworthy, please let me know. I appreciate your help.
Date/Time: 2007-06-11 00:49:54 +0200
OS Version: 10.3.9 (Build 7W98)
Report Version: 2
Command: Safari
Path: /Applications/Safari.app/Contents/MacOS/Safari
Version: 1.2 (125)
PID: 1033
Thread: Unknown
Link (dyld) error:
dyld: /Applications/Safari.app/Contents/MacOS/Safari Undefined symbols:
/Users/stuartbrooks/ppDir/pplibDAJNILib.jnilib undefined reference to _kCFAllocatorMallocZone expected to be defined in CoreFoundation

AccessControlException in signed applet for simply reading local file

I have a simple applet that reads specified local image files and uploads them to our server. On both Mac OS X and WinXP (firefox and IE7), I get the following error. I signed the applet using an InstantSSL code signing certificate (not so easy getting this to work, but I'm pretty confident I did it correctly).
java.security.AccessControlException: access denied (java.io.FilePermission /Users/scott/Documents/photos/Ken_and_Scott.jpg read)
     at java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
     at java.security.AccessController.checkPermission(AccessController.java:427)
     at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
     at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
     at java.io.File.length(File.java:813)
     at org.apache.http.entity.mime.content.FileBody.getContentLength(FileBody.java:89)So just on getting the file length, it's throwing this exception. Interestingly, this file passed both file.exists() and file.canRead() checks within the applet (in windows the path is a bit different of course but also passes both those checks). Also, that file has no read restrictions and I can load it in a browser no problem.
I assume I'm missing a step in the applet code signing process, maybe a step that says I'm allowed to read local files?

I figured out my issue, the apache HttpClient library needed to be signed too apparently.

Signed Applet for Netscape 4x

I have created a signed jar with SuperUser privileges under Netscape.
public void init() {
try {
if( Class.forName("netscape.security.PrivilegeManager") != null ) {
netscape.security.PrivilegeManager.enablePrivilege("SuperUser");
} catch( ClassNotFoundException cnfe ) {
cnfe.printStackTrace();
With this I am getting following error without any dailog prompting to grant permission.
netscape.security.ForbiddenTargetException: User didn't grant the SuperUser privilege.
Please help.
Thanks
Satish

Hi,
this is exactly the same problem I am facing here. Each time I try to grant/enable a capability, it is automatically denied without any dialog. Do we forget something?
I only signed the applet with the netscape signtool, not with a real certificate from verisign or such, does that matter?
Please let me know if you found out how to do it.
SkyScrap

RuntimePermission exception on RMI lookup on a signed Applet

Hi everybody,
Here is my problem : I want to call an ejb from my applet, using RMI.
But, as it is an applet, I get a security exception when I make the naming lookup :
java.security.AccessControlException: access denied (java.lang.RuntimePermission accessClassInPackage.sun.rmi.server)
I have been wandering for two days in the Java Sun sites and forums to find out how to pass through this problem.
Too many information is no information : I am not sure to have the correct answer; but here is what I have found :
All I have to do is to make a self-signed Applet (for testing purpose, before having a real certificate), using keytool and jarsigner, and use it with Java Plugin. Doing that will give AllPermission to the signed code, if the user agrees through a Java Plugin dialog.
(see http://java.sun.com/products/plugin/1.2/docs/nsobjsigning.html)
But... that doesn't work (who said 'of course' ?) :
I get the granting dialog, and even if I agree, I always get the same java.lang.RuntimePermission accessClassInPackage exception.
The strange think is that I tried to write a file on the client machine for testing the permission, and that works fine with this same signed applet.
I think that AllPermission implies FilePermission and also RuntimePermission, doesn't ?
Is this behaviour related to my self-signed certificate ? (in this case, why can i write a file ?)
What am I missing ?
Any help will be welcome,
many thanks
bernard
PS. : Of course, i don't want the user to modify its java policy or security configuration as it is often "mission impossible".

Sorry, i forgot : i am using Java Plugin v 1.3.1_02
B

Sign Applet

Hi all
I am new in java programing.
I made program (some graphics and textfields and buttons , xml ) and i can't open it in IE.( it works ok in NetBeans)
So my bet is that i need to create signed applet. I was reading tutorials how to do that, but still i was unable to do that.
here is my program: http://jump.fm/SCMEM
can somebody help me create certificate for this program ?
I hope some on can spend some time to help me.

well, i found package name jar file, is this what i need ?No. As I already said, you need the JAR-creating ability of your IDE, or the [JAR tool|http://java.sun.com/javase/6/docs/technotes/tools/windows/jar.html].
i guess is to difficult to make signed applet for me.Any Java programmer must (a) know what a JAR file is and (b) be able to create one with the JAR tool.
because i can't understand how to do that (because of wak programming and English knowledge).It has more to do with failure to follow up the information I gave you, or indeed do any proper research at all.

Restricting signed applets!

hi all...
I have a very direct question, yet for hours i've been scouring around for a direct answer. just tell me, for a signed applet, does it haf ALL PERMISSIONS? is it not possible to restrict a signed applet, for example, able to read a file but cannot write a file? could this actually be set inside the java.policy file?
i haf read many forums, some saying signed applet will haf all permissions, while others saying otherwise. if we set the "usepolicy" property permission, i understand that signed or unsigned is no different, both adhering to the policy file, but that's not what i want. i've read that by not using "usepolicy", u can only grant permissions for unsigned applets in the policy file. is this true?
i know i'm long winded, but this is frustrating...
let's assume i'm using j2sdk 1.4.2_06.
can we clear this issue once and for all?
p/s: on a personal note, i think that if u cant restrict what a signed applet can do, that is reaaaaalllyyyyyyy bad....

could this actually be set inside the java.policy file?Yes, in the java.policy under grant {
permission java.lang.RuntimePermission "usePolicy";
This will tell the jre to use policy for all applets including the signed ones.
The following:
grant codebase = "http://www.google.com/-" {
permission java.lang.RuntimePermission "usePolicy";
Will tell the jre to use policy for all the applets comming from google.
There is a way to grant based on who signed the applet but I never got it working:
http://forum.java.sun.com/thread.jsp?forum=63&thread=409341
You are looking for a policy that is used for all signed applet, I guess that is the policy
I never got working.
Here is the tutorial on the java.policy
http://java.sun.com/docs/books/tutorial/security1.2/toolsign/wstep3.html

Security problem when signed applet dynamically load plugins

Hi!
I have one problem : "security problem when signed applet dynamically load plugins"
This is the scenario:
the main program [app.jar]
. contain applet and shared library (interface & implement of common class)
. it is signed and run normally on browser
. it can draw image loaded from other URL [ex] http://bp1.blogger.com/image.jpg
. the image loader is in the shared library
. dynamically load amazon.jar through URLClassLoader and reflection
the plugin [amazon.jar]
. search amazon product [ex] Harry Potter book
. draw image on applet
. use image loader from shared library, BUT CANNOT LOAD IMAGE
The question: "Why it cannot load image, because the image loader is in the shared library which has been signed and working?" I tried to sign the amazon.jar too, but it did not work.
Your reply would be very helpful. Thank you.
Sovann

hello. i have create a signed applet for A.jar. A.jar include two package B and C. the main applet class is within B.
B need some classes in C to run the applet. but i got the error that class in package c are not found.
what shall i do?

File read access denied for signed applet

Hi:
I have a signed applet with a certificate generated with the keytool. Yet, I keep getting this error:
java.lang.Exception: java.security.AccessControlException:
    access denied (java.io.FilePermission C:\WINDOWS\system32\aetpkss1.dll read)The error is produced when the method loadKeyStore(pin) below is called.
    private KeyStore ks;
    private Provider provider;
    private static final String providerName    = "PKCS11";
    private static final String providerLibrary = "aetpkss1.dll";
    public void loadKeyStore(String pin) throws IOException,
     CertificateException, KeyStoreException, NoSuchAlgorithmException {
     if (provider == null)
         registerProvider(providerLibrary);
     try {
         ks = KeyStore.getInstance(providerName,provider);
     } catch (Exception e) {
         throw new KeyStoreException("Failed get keystore instance\n"
                         + e.getMessage());
     try {
         ks.load(null, pin.toCharArray());
     } catch (Exception e) {
         throw new KeyStoreException("Failed load keystore\n"
                         + e.getMessage());
    public void registerProvider(String library)
     throws FileNotFoundException, KeyStoreException {
     String fileName;
     if (new File(library).isAbsolute())
         fileName = library;
     else
         fileName = getAbsolutePath(library);
     if (!(new File(fileName).exists()))
         throw new FileNotFoundException("No such file: " + fileName);
     String config = "name = " + providerName + "\n"
         + "library = " + fileName;
     ByteArrayInputStream confStream =
         new ByteArrayInputStream(config.getBytes());
     try {
         provider = new sun.security.pkcs11.SunPKCS11(confStream);
         Security.addProvider(provider);
     } catch (Exception e) {
         throw new KeyStoreException("Can initialize " +
                         "Sun PKCS#11 provider. Reason: " +
                         e.getCause().getMessage());
    private String getAbsolutePath(String lib) throws FileNotFoundException {
     String[] searchPath;
     /* NOTE: This should be modified to suit different versions of   *
      *       Windows and not just Windows XP                         */
     if (System.getProperty("os.name").matches("^(?i)Windows.*")) {
         searchPath = new String[] { "C:\\WINDOWS\\system32" ,
                         "C:\\java" };
     } else {
         searchPath = new String[] { "/usr/local/lib/" };
     for (int i = 0; i < searchPath.length; i++) {
         if ((new File(searchPath[i] + File.separator + lib).exists()))
          return (searchPath[i] + File.separator + lib);
     throw new FileNotFoundException("Library not in search path " + lib);
    }The above code is called by a java script, the class' constructor is empty.
The error appears not to be caught by my code. I have tried to insert try/catch statements everywhere to figure out where this error is produced.
The code is write off of the applet for signing with a smart card by Svetlin Nakov - and his applet works!
I have also made a CLI application that uses the above code and it works perfectly.
So: Something is wrong either with my certificate, the signing method, signature verification or something completely different. Any hints?
The certificate I generated with
keytool -genkey -keystore mystore -alias me
keytool -seflcert -keystore mystore -alias meI have tired both with and without the selfcert step.
Thanks! Erik

The problem has been identified: Placing registerProvider() in the constructor the error no longer occurs, instead an error is produced when the key store is loaded.
It appears that the javascript code is not trusted and so, even though the applet is signed, access privileges are restricted to those of the java script.
A solution to this problem is not clear, but possibly, serving the pages from a trusted server, the java script will be trusted, some documentation seem to indicate.

Include many jars for a complex signed applet in html file??

hello
I'd like to know how it's possible to put a signed applet in an html file, that needs many jar files.
I explain myself: I know that to create a signed applet and to put it in an html file, I need to create a Jar file that contains this applet, create a private key with keytool, sign the jar and include it in my html file with the tag <applet code="....." archive="......jar".... />
This works fine if my applet is a simple program that only uses the clases present by default in the jdk.
In my case, I have a big project, with many packages. In one of these packages, I have my applet that uses some classes of the other packages, which use classes from imported jars, such as BouncyCastle, and others...
There is still no problem when I run the applet from the applet viewer.
The problem appears when I put the JAR file with all these classes in the html file: there is a problem since it doesn't know anything of these classes imported from these jars.. It's quite obvious actually.
My question is: how do I do to make the html file aware of these classes? Is there an html tag that allows us to include many jar files? Do I have to decompress all these jars, take all the directories, add them to the directories of my project and create a BIG jar (that's what I did, but it's really dirty, and heavy! (11M))??
Does anyone have an idea about how I can do it?
Thanks for your help
Philippe

11 MB is pretty big for an applet.
Let's say your applet uses java 3d, normally a client would download and
install this seporately, meaning the jars needed end up in lib/ext directory where
any applet can find them.
Check what applets need to be installed (put in lib/ext) and what can be
downloaded:
<object .....
<param name="archive" value="myJar.jar, myOtherjar.jar" />

Grant permission for a signed applet

I have my jar file signed. Now, I hate to have the user to modify their .java.policy file, beside, I did not have my certificate verified by Verisign. Is there any other way to do it? I have read some posts which the user of the signed applet will see a pop up dialog while loading the signed applet, if they click on "grant all access", then the applet will have all the permission. Can anyone tell me how to do that?
Thanks
Andy

nicoleman1 put together a "tutorial" on signing your applet (jar). The instructions will work for all browsers that support the Java Plugin.
Here is a link to the thread:
http://forum.java.sun.com/thread.jsp?forum=63&thread=174214
Pete

Loading problem for Signed applet on MAC OS

Hi All
I�m trying to test my application on MAC OS (For versions: 10.2.6 as well as 10.4.x)
For MAC 10.2.6 OS Java version is 1.4.1_01 and
For MAC 10.4.x OS Java version is 1.4.2_07
The code is compiled on Windows machine having Java version 1.4.2_07
There�s a functionality which is calling signed applet (signed JAR for applet) and when this functionality is called, following error encounters:
Java(TM) Plug-in: Version 1.4.1_01
Using JRE version 1.4.1_01 Java HotSpot(TM) Client VM
java.io.IOException: Server returned HTTP response code: 403 for URL: http://myMachineName: port/appName/UploadDownloadAppletJava.jar
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:709)
at sun.plugin.net.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:384)
at sun.plugin.net.protocol.http.HttpUtils.followRedirects(HttpUtils.java:39)
at sun.plugin.cache.CachedJarLoader.download(CachedJarLoader.java:302)
at sun.plugin.cache.CachedJarLoader.load(CachedJarLoader.java:128)
at sun.plugin.cache.JarCache.get(JarCache.java:172)
at sun.plugin.net.protocol.jar.CachedJarURLConnection.connect(CachedJarURLConnection.java:93)
at sun.plugin.net.protocol.jar.CachedJarURLConnection.getJarFile(CachedJarURLConnection.java:78)
at sun.misc.URLClassPath$JarLoader.getJarFile(URLClassPath.java:580)
at sun.misc.URLClassPath$JarLoader.<init>(URLClassPath.java:541)
at sun.misc.URLClassPath$3.run(URLClassPath.java:319)
at java.security.AccessController.doPrivileged(Native Method)
at sun.misc.URLClassPath.getLoader(URLClassPath.java:308)
at sun.misc.URLClassPath.getLoader(URLClassPath.java:285)
at sun.misc.URLClassPath.getResource(URLClassPath.java:155)
at java.net.URLClassLoader$1.run(URLClassLoader.java:190)
at java.security.AccessController.doPrivileged(Native Method)
Due to which cannot access Applet class (which is inside UploadDownloadAppletJava.jar) and operation is failed.
(It works perfectly fine on Windows XP with both IE 6 and Firefox browsers).
On MAC I'm testing on FireFox.
Code which calls to applet is:
<applet
name=UploadDownloadApplet
code="UploadDownloadApplet.class"
codebase=/appName/
archive=UploadDownloadAppletJava.jar
width=0 height=0>
<PARAM NAME=cabbase VALUE=UploadDownloadApplet.cab>
<PARAM NAME=action VALUE=<%= action %>>
<PARAM NAME=workingAreaMac VALUE="<%= workingAreaMac %>">
<PARAM NAME=workingAreaPC VALUE="<%= workingAreaPC %>">
<PARAM NAME=processId VALUE=<%= processId %>>
<PARAM NAME=downloadBaseProductInd VALUE=<%= downloadBaseProductInd %>>
<PARAM NAME=initTime VALUE=<%= initTime %>>
<PARAM NAME=httpSessionId VALUE="<%= httpSessionId %>">
<PARAM NAME=userId VALUE="<%= userId %>">
</applet>
Please suggest some guidelines

java.io.IOException: Server returned HTTP response code: 403 for URL:
http://myMachineName: port/appName/UploadDownloadAppletJava.jar
Have you tried entering the URL into a browser window and see what happens?
Message was edited by:
wangwj

Signing applets for a period

Similar Messages

Maybe you are looking for