Code signing certificate validation by Java

Question

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java.

I am wondering if the code signing certificate (the “final cert”) must already be in the client Java truststore, or if the client only needs the Root CA (and its chain) in the Java truststore to validate it?

I can’t find Java docs that are really explicit about that, so I need technical details about the code signing certificate validation (where the certificate is fetch from, what is needed), not about the signing process.

Answer 1

If a jar is correctly signed, the verifier (often but not necessarily a network client) needs only the root, and if you use a public CA that root will usually already be there.

Specifically, a KeyStore privateKeyEntry is supposed to contain the full cert chain (although if the cert is self-signed the chain is only that one cert). When jarsigner signs using that privatekey (by alias) it creates a PKCS#7 SignedData detached signature, which includes the cert chain. For the case where the keystore can't provide the chain, jarsigner since Java7 has -certchain option to add them, see http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html .

To verify a jar signature (or any signature containing a cert chain) Java actually can use any cert in the chain found in the local truststore. Since roots exist for the purpose of concentrating trust for all chains under them, it's conventional and easiest to have only roots in the local truststore. And JRE includes a default cacerts containing nearly 100 roots for "well-known" public CAs like Verisign and GoDaddy.

jarsigner -verify -verbose -certs [-keystore if_not_default] test.jar will show you the cert chain used, and mark the cert(s?) found in the truststore with its alias in parentheses at the right.