0

I am attempting to deploy a JNLP file to a server, enabling clients to download my Java application for use on their machine. I have purchased an open source certificate from Certrum as suggested by this post

I followed the instructions in the post above to export my pem file as a pfx via chrome, sign my jar , and i also added a -tsa flag to timestamp the jar. Here are the commands i used to sign/verify the jar using the exported pfx file:

keytool -list -v -storetype pkcs12 -keystore Certificates.p12 

jarsigner -storetype pkcs12 -keystore Certificates.p12 Application.jar "cservices.certum.pl"  -tsa http://timestamp.comodoca.com/rfc3161

jarsigner -verify Application.jar

This gives me the following output:

jar signed

jar verified.

Warning: This jar contains entries whose certificate chain is not validated.

Re-run with the -verbose and -certs options for more details.

Now when I deploy and download the software to my machine Java is still telling me that I cannot open the app as it is self-signed and therefore a security risk.

How can i validate my certificate chain? is that the error causing my security issue?

Below is my Application.jnlp file deployed to my tomcat server

<?xml version="1.0" encoding="utf-8"?> 
<jnlp spec="1.0+" codebase="http://[url]/" href="Application.jnlp">
<information>
    <title>Application</title>
    <vendor>vendor</vendor>
    <homepage href="http://localhost:8080/" />
    <description>Testing Testing</description>
</information>
<security>
    <all-permissions/>
</security>
<resources>
    <j2se version="1.8+" />
    <jar href="Application.jar" />
</resources>
<application-desc main-class="com.me.Application" />
</jnlp>
Community
  • 1
  • 1
a.hrdie
  • 716
  • 2
  • 14
  • 35
  • Did you add the *.jnlp file to your application *.jar file as `/JNLP-INF/APPLICATION.JNLP` prior to signing? – davidrmcharles Nov 05 '15 at 21:12
  • i have, the only way i can get the jar to run is manually adding the certificates.pfx file to my trusted certs. is there a way to do this during the download? – a.hrdie Nov 06 '15 at 10:10
  • 1) Try to config Java settings (in Control Panel) to allow running self-signed applications. 2) Check a content of Application.jar. Maybe there are JAR's not signed by your cert. For that run: `jarsigner -verify -verbose -certs Application.jar` – Marcin Stachniuk Jan 22 '16 at 10:58
  • @a.hrdie did you solved this? how? – Amogh Aug 27 '16 at 08:02
  • Hi, Im afraid i was not able to solve this and just opted for a signed .jar download from the website instead. Hope you have more luck @amogh – a.hrdie Aug 27 '16 at 20:03

0 Answers0