Search code examples
javasecurityjava-web-start

Install certificate automatically for JWS application

My JWS application jar is signed1 and when I launch that certificate it does not ask for anything and simply throws an exception saying your application has been blocked.

If I install that certificate it works, but how I force my application to give a message to install certificate so that it is installed automatically? I want something like as shown below.

  1. I have created a certificate using keytool -genkey and then using jarsigner signed that jar file.

Solution

  • I have created a certificate..

    These days, signed code needs to be signed using a digital certificate issued by a certification authority. There is really no way around it (or if there was, it would be a security bug - and be quickly fixed).

    The digital certificate created by us as developers has no 'key chain' that points back to a Certification Authority that issues certificates after verifying the identity of the person that requested the certificate. Because CAs are trusted to check these details, Sun/Oracle imports some of their 'root certificates' into the JRE security system. Any certificate that has a key chain that points back to one of those certificates will show the dialog as seen in the screen shot.

    It is all about security for the end user. Since I can generate a certificate with the JDK claiming I am you, the JRE won't accept the certificate no matter who makes it - unless the certificate has been issued by a CA.