2

I wonder how to manage/deploy a code signature certificate used by the JVM in a corporate context. Suppose you signed a Java applet (executed in browser by corporate users), how do you deal with the certificate, as it is needed by users to verify code signature ?

We can embed it in the JVM, but we could also deploy it via GPO or Public Key Policies in the windows certificate store. What is the best solution ? (keeping in mind revocation or renewal process).

1

Best way seems to use a code signing certificate from a well-known CA. Since well-known CA certificates are already trusted by Client (browser, OS), there is no need for additional maintenance with this setup.

Java Applet & Web Start - Code Signing states that

...Users will be better protected by maintaining up-to-date versions of the JRE on their systems, combined with requiring code that is signed by a Trusted Certificate Authority (rather than self-signed or unsigned code)...

...self-signing is primarily of value to developer and intranet applications as it also requires managing the keystore for Java...

When using a certificate from CA, renewal poses no problems, we may just sign with renewed certificate. Trusted timestamping, while adding complexity, allows Clients to validate your signature even after your signature expires, given that it had been valid during signing operation (see Signing code for the long haul).

Certificate revocation is checked using Online Certificate Status Protocol (OCSP) at the Client. For details please see Revocation Checking for Java Applications section here.

Nonetheless, there are many large enterprises who manage an in-house CA, primarily for issuing server certificates. If such an infrastructure is already in place, we may assume that internal CA certificates are already being distrubuted to Clients in one way or another, for Clients to be able to trust the servers. If this is the case, issuing code signing certificates from the same CA may not cause additional administrative overhead.

| improve this answer | |
  • Ok but I am dealing with corporate certificates (issued by our corporation); so it is out of scope to deal with well-known CA ! – crypto-learner Aug 31 '15 at 7:33
  • 1
    Then I guess only the last paragraph may apply. Still, I think that since code signing certs cost around a few hundred dolars/year, they shall be well within a corporate budget. Coupled with reduction in administrative overhead in a 'corporate context', they may be proposed as a well justified alternative. – Kurtcebe Eroglu Aug 31 '15 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.