6

I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed.

I used the certificate/key used for the apache2 ssl to sign the jar. In order to do this I had to create a new keystore using the key/certificate, and the Not Yet Commons SSL library.

If I run jarsigner -verify on the applet jar, i get:

This jar contains entries whose signer certificate's ExtendedKeyUsage extension
doesn't allow code signing.

The applet is still getting an invalid certificate error. I can view the certificate, and it is the same certificate used for SSL. The error message says that it was blocked due to being self-signed, but this is not a self-signed certificate!

I can run the applet when I move the security settings down to "medium", but this is unacceptable for this project.

The certificate I used to sign this is part of a chain (about 4 long). Is there a way I need sign the jar using the whole chain? Do I need to use a Code Signing certificate?

Improve this question
1

1 Answer 1

Reset to default
4

If jarsigner -verify tells you that there is a problem, then chances are that the JVM will refuse your applet, for the same reason, since they use the same code base.

The Extended Key Usage is a standard certificate extension which indicates the exhaustive list of "usages" for which the certificate is allowed. In this case, it appears that jarsigner (and thus, presumably, the JVM) is adamant on the certificate containing that extension with the specific OID which says "code signing". It is up to your CA to write the relevant extension; a certificate for a SSL server will not contain such an extension by default (if it has an "extended key usage", it will contains OID for things like "server authentication", not for "code signing").

You will have to obtain a specific code signing certificate. Not all CA sell this sort of thing.

Improve this answer
3
  • We just spent stupid time trying to convince our internal CA to generate the appropriate type of cert, and finally bailed and went with a code signing cert from a major CA. There's a real lack of documentation for this sort of thing. $300/year was cheaper than the engineer hours we spent trying to figure it out.
    – gowenfawr
    Jan 30, 2014 at 14:01
  • It's good to know I'm not the only one running into these issues.
    – aglassman
    Jan 30, 2014 at 15:11
  • A certificate without any flags works fine too, if you can get a trusted CA to sign it.
    – flup
    Dec 28, 2014 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .