I've a question about using a signed
applet . I've a specific
solution in mind I will ask about but any other ideas for other
approaches'd be welcome of course.
I've an applet which provides some information for putting on a web
page. It needs to be an applet as it's whole purpose is to obtain some
information from the local
machine and put it on a web page with other
information. The information I need is on
file s on the user's machines
so in order to read them this needs to be a signed applet. Now, this is
just a private web page thing for a close
group of users who are known
to me. They were previously happy
run ning an .exe supplied by me so the
security implications of running a signed applet aren't really
relevent - they will be happy to do so.
But because this is a private thing I do not have any money to spend on
it so getting a "real"
code siging certificate is out of the question
(Unless someone knows where I can get one for much less that the cost
that verisign etc charge...) so I'm using a self signed certificate. I
do not see this as a problem in itself in any way except that the applet
is supposed to blend into the web page and when it's run the dialog
saying it's a signed applet, and questioning the signers identity comes
up. Fair enough.. I can tell the users to check the certificate and
click the
accept anyway button. But it destroys the look of the website
with a dialog box. I can tell the users to click on the always accept
this certificate checkbox and then everyone is happy, it'll no longer
ask them when they run the
application in future.
Okay, so my question - I'd like to be able to do one of two things...
1) Write an applet which installs the certificate into the trusted
certificates list. It'd very clearly prompt the user and tell them
what it was doing and of course would've to be signed in the first
place to make this possible I image.
2) Detect if the certificate is already trusted. I'd ideally like to be
able to do this from an unsigned applet so that I can redirect the user
to a page of instructions if the certificate is not trusted without
exposing them to a whole lot of popup warnings.
The first
option I'm sure is possible - but I can not seem to find any
java
API (application
programming interface)to add a trusted certificate to the
store that the browser
uses. Can someone
point me in the right direction, if there is such an
API.
The second one I do not really think is possible, I'd almost hope that
an unsigned applet would not be able to find out what cewrtificates the
user trusts, but it'd make life easier for me.
Sorry for the long question, I hope someone can help, or suggest an
alternative approach.
Thank you for reading :)
I do not exactly know which keystore in JAVA is used to store the
trusted certificate. It may be the cacerts file inside lib/securty of
the
JRE , or somewhere inside the .JAVA
directory in your home
directory. You may find it out through some experiments.
When you locate the file. I believe you can use the KeyStore API (application programming interface)to
open it and insert you cert and save it back. In order to
load the
certificate, I think you can create a CertificateFactory and load the
cert from a stream. Read
http://JAVAalmanac.com/egs/JAVA.security.cert/ImportCert.html for
details.
Most keystores inside JRE have either an empty
password or something
like "changeit".
Goo
Blogs related to Adding certificate to trusted certificates using an applet?
Citrix and Mac OS X, go together like... well, not so great at first
So here, if you are in Bermuda and
using Citrix with a Quo Vadis
certificate, and your Mac Citrix client is talking smack, try this (oh yeah, and it has to be in FireFox): 1) Go to http://www.quovadis.bm/root/ and scroll to the part
...
ActivCard Debuts Enterprise Access Solutions for Single Sign-On ...
oLeverages existing digital identity infrastructures through open standards support of leading directories,
certificate authorities, building access systems, and provisioning systems oProvides unparalleled security for
trusted,
...
Setting up Apache Tomcat and a Simple Apache SOAP Client for SSL ...
Importing your new
certificate from the CA's
Using Keytool. (after importing server's cert as
trusted CA cert) keytool -import {-alias alias} {-file cert_file} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass
...
Carriers Abuse Java ME Signing
In summary, signing a single application with one
certificate costs hundreds of dollars per year. There's no one
certificate that works on all phones and carriers. To get the
certificate required for some phones the app must also be
...
RE: Charting Plugin Pending feature (updated)
Bug, JDB-108, Can't connect to jira over https with self signed
certificate, Eugene Kuleshov, Resolved. Bug, JDB-107, JiraServerFacade.validateServerAndCredentials() does not allow to see error details, Eugene Kuleshov, Resolved
...
Re: LDAP login problem
For SSL to work, > the name you use must match the in the
certificate issued
... installed under Personal
Certificates and
Trusted Root Certification
... Need to mention that this > >> >> > was > >> >> > tested
using JXplorer
java app.
...