Signing .Jar file

Question

Im sitting with a bit of a problem. Im busy creating a php/html website (intranet) for our support team to make life a bit easier when support linux machines.

I have a .jar app called mindterm (the free version) and want to run it as an applet in the site.

However according to their site you have to have the .jar file signed before loading it as an applet otherwise it cant open tcp connections.

So i did as much research as i could in the time i had and came up with the jarsigner.exe and keytool.exe files provided in the JDK installation.

However i do not have a clue how to go about signing this app so that i can actually use it.

Any help?

Thanks

Your problem is not the signing process, it is the certificate & private-key you need. This "Java code-signing-certificate" has to be bought by a Trust-Center. — Robert, Jun 19 '13 at 09:40

Rajesh J Advani · Accepted Answer · 2013-06-19T15:12:39.757

20

First create a key-pair using keytool.

keytool -genkey -alias somekeyname

Then use jarsigner to sign it with the key you just created.

jarsigner /path/to/jar somekeyname

Note, you need to use the same alias (somekeyname here) as the one you create the key with.

Now, since the certificate is self-signed, the user of your applet will be prompted to approve the certificate. Once they do so, your tcp connections should work.

Since I assume you're only using the applet internally in your organization, self-signed certs should be fine. Otherwise you will have to pay for a certificate. In that case, your users will not need to accept the certificates after the first time (if they choose Always Allow").

edited Jun 19 '13 at 15:12

answered Jun 19 '13 at 09:39

Rajesh J Advani

5,585
2
23
35

thanks for the info will try that asap. everything is done internally so we are not too phased about having a selfsigned cert – Stroes Jun 19 '13 at 10:02
1

*"Otherwise you will have to pay for a certificate. In that case, your users will not need to accept the certificates manually."* Buying a certificate does not *bypass* the security dialogs, it simply makes them prettier, and remembers 'always allow'. ;) – Andrew Thompson Jun 19 '13 at 14:45
Oops. Yes, hadn't used a signed applet in a long time. Updated the answer to say this. – Rajesh J Advani Jun 19 '13 at 15:13

score 1 · Answer 2 · answered Jun 19 '13 at 09:41

1

You can sign jars using :

Install this Eclipse plugin

Eclipse Webstart Plugin.

You will just need to export as "Webstart". It will prompt you to sign the jars.

DEMO

answered Jun 19 '13 at 09:41

Makky

17,117
17
63
86

score 1 · Answer 3 · edited May 23 '17 at 12:13

Combined the top answer with some useful hints to get completely unattanded script:

keytool -genkey -noprompt -alias Alias -dname "CN=Hostname, OU=OrganizationalUnit, O=Organization, L=City, S=State, C=Country" -keystore path.to.keystore -storepass password -keypass password -validity 3650
jarsigner -keystore path.to.keystore -storepass password -keypass password -signedjar signed.jar unsigned.jar Alias

score -1 · Answer 4 · answered Jun 19 '13 at 09:40

This is a somewhat complex area, and you essentially need to know what you are doing, and you may have to pay real money for a signing certificate.

The Sun Java Tutorial cover the topic well: http://docs.oracle.com/javase/tutorial/deployment/jar/signing.html

If the intent is to give the support people a ssh client, there might be better solutions.

Signing .Jar file

4 Answers4

Linked