Search code examples
javaappletcode-signing-certificatejarsigner

Renewed code signing certificate does not work

I had a Code signing certificate from GoDaddy which expired back in February, and I used it to sign JAVA jar files, copied it to an ftp server and ran them as applets. Everything worked fine.

In January I made a renewal for one year.

Despite the fact, that I made what was suggested in the GoDaddy guide (downloaded the zip file, extracted it, and imported it in the keystore) it was not working, when signing the jar file it still gave me the warning, that my certificate will expire in six months.

So I decided to re-key my certificate, and followed exactly the steps from GoDaddys website: First, I made a new keystore, to have a fresh start:

keytool -genkey -alias sboda -keyalg RSA -keysize 2048 -keystore keystore.jks

then I entered the needed information, like name, organization, etc. and generated the CSR file

keytool -certreq -alias sboda -file file.csr -keystore keystore.jks

After this, I copy pasted the CSR into the CSR box on the website, and asked for rekey.

Downloaded and extracted ZIP file, imported it to the newly created keystore with

keytool -importcert -file filename.pem -keystore keystore.jks

I trusted the certificate, and the certificate was imported. I signed the jar with

jarsigner -verbose -keystore ./keystore.jks -tsa http://tsa.starfieldtech.com/ ~/workspace/example.jar sboda

it gave me the warning: Warning: The signer certificate will expire within six months.

I copied the jar file to the server, and gave this error, when I try to launch the applet:

enter image description here

The other applets, that were signed earlier, are working fine... Did I miss anything?

Already contacted GoDaddy support two times, but they were not really helpful, so I thought I also ask here...

Solution

  • In the meantime I figured it out, thanks to other vendors documentation. Instead of

    keytool -importcert -file filename.pem -keystore keystore.jks

    use

    keytool -import -v -trustcacerts -alias alias -file filename.pem -keystore keystore.jks

    hopefully other will not stumble into this problem, I lost half a day with it.