Sagewire Logo

Adding certificate to trusted certificates using an applet?

2 Message(s) by 2 Author(s) originally posted in java security


From: john.burton Date:   Wednesday, November 22, 2006
I've a question about using a signed applet . I've a specific
solution in mind I will ask about but any other ideas for other
approaches'd be welcome of course.

I've an applet which provides some information for putting on a web
page. It needs to be an applet as it's whole purpose is to obtain some
information from the local machine and put it on a web page with other
information. The information I need is on file s on the user's machines
so in order to read them this needs to be a signed applet. Now, this is
just a private web page thing for a close group of users who are known
to me. They were previously happy run ning an .exe supplied by me so the
security implications of running a signed applet aren't really
relevent - they will be happy to do so.

But because this is a private thing I do not have any money to spend on
it so getting a "real" code siging certificate is out of the question
(Unless someone knows where I can get one for much less that the cost
that verisign etc charge...) so I'm using a self signed certificate. I
do not see this as a problem in itself in any way except that the applet
is supposed to blend into the web page and when it's run the dialog
saying it's a signed applet, and questioning the signers identity comes
up. Fair enough.. I can tell the users to check the certificate and
click the accept anyway button. But it destroys the look of the website
with a dialog box. I can tell the users to click on the always accept
this certificate checkbox and then everyone is happy, it'll no longer
ask them when they run the application in future.

Okay, so my question - I'd like to be able to do one of two things...
1) Write an applet which installs the certificate into the trusted
certificates list. It'd very clearly prompt the user and tell them
what it was doing and of course would've to be signed in the first
place to make this possible I image.
2) Detect if the certificate is already trusted. I'd ideally like to be
able to do this from an unsigned applet so that I can redirect the user
to a page of instructions if the certificate is not trusted without
exposing them to a whole lot of popup warnings.

The first option I'm sure is possible - but I can not seem to find any
java API (application programming interface)to add a trusted certificate to the store that the browser
uses. Can someone point me in the right direction, if there is such an
API.
The second one I do not really think is possible, I'd almost hope that
an unsigned applet would not be able to find out what cewrtificates the
user trusts, but it'd make life easier for me.

Sorry for the long question, I hope someone can help, or suggest an
alternative approach.
Thank you for reading :)


From: sgoo Date:   Friday, November 24, 2006
I do not exactly know which keystore in JAVA is used to store the
trusted certificate. It may be the cacerts file inside lib/securty of
the JRE , or somewhere inside the .JAVA directory in your home
directory. You may find it out through some experiments.

When you locate the file. I believe you can use the KeyStore API (application programming interface)to
open it and insert you cert and save it back. In order to load the
certificate, I think you can create a CertificateFactory and load the
cert from a stream. Read
http://JAVAalmanac.com/egs/JAVA.security.cert/ImportCert.html for
details.

Most keystores inside JRE have either an empty password or something
like "changeit".

Goo



Next Message: Unique JVM / system_specific number


Blogs related to Adding certificate to trusted certificates using an applet?

Citrix and Mac OS X, go together like... well, not so great at first
So here, if you are in Bermuda and using Citrix with a Quo Vadis certificate, and your Mac Citrix client is talking smack, try this (oh yeah, and it has to be in FireFox): 1) Go to http://www.quovadis.bm/root/ and scroll to the part ...

ActivCard Debuts Enterprise Access Solutions for Single Sign-On ...
oLeverages existing digital identity infrastructures through open standards support of leading directories, certificate authorities, building access systems, and provisioning systems oProvides unparalleled security for trusted, ...

Setting up Apache Tomcat and a Simple Apache SOAP Client for SSL ...
Importing your new certificate from the CA's Using Keytool. (after importing server's cert as trusted CA cert) keytool -import {-alias alias} {-file cert_file} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass ...

Carriers Abuse Java ME Signing
In summary, signing a single application with one certificate costs hundreds of dollars per year. There's no one certificate that works on all phones and carriers. To get the certificate required for some phones the app must also be ...

RE: Charting Plugin Pending feature (updated)
Bug, JDB-108, Can't connect to jira over https with self signed certificate, Eugene Kuleshov, Resolved. Bug, JDB-107, JiraServerFacade.validateServerAndCredentials() does not allow to see error details, Eugene Kuleshov, Resolved ...

Re: LDAP login problem
For SSL to work, > the name you use must match the in the certificate issued ... installed under Personal Certificates and Trusted Root Certification ... Need to mention that this > >> >> > was > >> >> > tested using JXplorer java app. ...


Programming | Sports | Autos

copyright 2006
Valid XHTML 1.0 Transitional