Search code examples
java-mecertificatecode-signingmidp

Digital certificate for J2ME apps

I don't have any experience on using a digital cert.

Recently I wrote an application in J2ME and Qt for the Nokia S40 and S60 /Symbian ^3/Anna/Belle series phones.

My question is mainly on S40 J2ME phones.

My app need to read /write from memory cards and thus needs a digital cert signing.

I plan to let users download my apps from my site and my questions are:

  • If I bought a cert, does it mean that I use the same cert to sign any number of J2ME apps? Or one cert one app?

  • After signing an app with a cert, will it run after the cert expired? Suppose the cert is valid at the time signing the code. I read some articles about timestamp for PDF documents and Microsoft code signing, and not sure whether it is needed for J2ME apps.

  • I assume many S40 users won't connect to internet. But when a user tries to install the MIDlet, is it necessary to connect through network to the cert issuer's site to verify the cert?

Solution
    • You can use the purchased certificate to sign any number of applications until it expires
    • Your midlet will still work and install but you will not be able to sign new ones with an expired certificate. See also this post
    • certificate validation does not require network access. The root certificate of the issuer is already on the device. Be aware that you should use a certificate issuer whose root certificate is on your target devices.