Re: Signing an applet
On 12/13/2013 8:40 AM, emf wrote:
I am trying to understand how to self-sign an applet. I've already checked websites
that provide directions, but unfortunately I realized that my relevant knowledge is
too limited to start understanding what they are talking about, so I post here hoping
I'll get some help to get me started.
To sign a jar file:
Part I: Create an unsigned applet that just needs to be signed to work:
1) Make sure your applet is in a package. Don't use the default,
nameless package for signed code. (It may be possible, but
it can't be a good idea for applets you plan on sharing with the
world.) For this demo, let's use "mypackage" for the package
name, and "MyApplet" for the applet name.
Here is the demo Java code I used:
// Signed MyApplet Demo - A simple Applet, signed. This applet
// attempts "read" access the "user.dir" property, normally not
// allowed from the "sandbox". By signing the applet, you can have
// it run with "app-permissions".
//
// Written 12/2013 by Wayne
package mypackage;
import java.io.*;
import javax.swing.*;
public class MyApplet extends JApplet {
public void init () {
JLabel label = new JLabel( "Hello from a Signed Applet!" );
add( label );
try {
File file = new File( "." );
label.setText( "The current directory is "
+ file.getAbsolutePath() );
} catch ( Exception ex ) {
ex.printStackTrace();
label.setText(
"Security exception while attempting access "
+ "to current directory" );
}
}
}
2) Package the applet into a JAR file. The applet must be in a JAR file
before a certificate can be attached to it. You should also add
a manifest file to specify permissions and other information for
your applet. Without this, your signed applet runs without
restrictions, and could be run from any website. Let's call
the jar file "MyApplet.jar".
3) Create a UTF-8 text file (let's call it MyAppetManifest.txt)
with these three lines in it:
Permissions: all-permissions
Codebase: localhost 127.0.0.1
Application-Name: My Applet
Make sure each line ends with an NEWLINE (the Enter key).
A common error is to forget to hit Enter after that last line.
Currently (Java 7U45), the default is to run unsigned applets
in the sandbox, and signed applets with all permissions. So
the Permissions entry probably isn't needed. However, the default
has changed in the past and may change again, so including this
line seems a good idea to me. If your applet doesn't require
extra permissions, change "app-permissions" to "sandbox".
The "Codebase" entry lists the places from where this applet
can be loaded from. You need to list both localhost and
127.0.0.1, since one doesn't imply the other for some reason.
(For IPv6, you might need to add "::1", although I didn't see
where IPv6 addresses were supported in the manifest specification.)
Additional entries can be included to enhance security.
4) Use the jar utility to create a new jar file, and include the
manifest entries:
jar -cvfm MyApplet.jar MyAppetManifest.txt mypackage
(Additional files, such as media files, could also be included
in the jar; simply add file names to the end of the command line.)
5) In the <applet> tag of your HTML file, add the "archive" attribute.
The value of the archive attribute is the URL of a JAR file. If
the jar file is in the same folder as the HTML file, just
use the file name:
<APPLET CODE="mypackage.MyApplet.class" ARCHIVE="MyApplet.jar"
HEIGHT="120" WIDTH="400">
This should result in a working, non-signed applet. If the Java
control-panel security settings are set to "medium", you should
be able to run this applet. But, not if you use the default
security settings. For that, you must sign the applet.
Here is a sample HTML file showing the correct applet tag:
<HTML><HEAD>
<TITLE>My Applet - Demo signed applet</TITLE></HEAD>
<BODY>
<APPLET CODE="mypackage.MyApplet" WIDTH="400" HEIGHT="120"
ARCHIVE="MySignedApplet.jar">
</APPLET>
</BODY></HTML>
=============================================================
Part II: Sign the unsigned applet
When you sign your jar file, both the signature and
the public key are added to the jar file. But not just the
public key; that wouldn't prove much. The public key is part of
of a "certificate"; it is the certificate that is added to the jar.
A certificate includes your public key, the algorithm used to
sign the jar, the signer's ID, and other information. To prevent
forgery, the certificate itself must be signed by a well-known,
trusted third party called a "certificate authority" (or "CA").
Such CAs charge money for this service. Instead, you can become
your own CA, and then sign your own certificate. Such certificates
are called "self-signed". While you should never trust self-signed
applets from the Internet, you can use them yourself for testing your
code.
6) Create a key pair in user.home/.keystore:
keytool -genkeypair -alias mykey
This will create a private key to sign your code with, and a public
key that can be used to validate the digital signature. Since Java 6,
it will also generate a self-signed certificate. The keys will be
put in the default file in the default location (the file
".keystore" within your HOME directory).
The alias you give is the name for the key (sometimes, you may have
multiple keys and use different keys for different applications.)
There are defaults for everything (including the alias, which does
default to "mykey"), but you can use additional command line options
to override the defaults.
6a) One default is the "validity period" of 90 days. After that,
the certificate is expired and won't (or shouldn't) work. If you're
generating a key for use in a one semester Java course (four months),
or a longer course, you will probably want to change this default, like
so (for a one year certificate):
keytool -genkeypair -alias mykey -validity 364
The keytool utility is interactive. it will ask you for
your name, your organization's name, your department ("organizational
unit", and the city, state, and country of your organization. You
can include all that on the command line, but this way is often
easier.
You will also be prompted for a password to protect the private
key, and another for the keystore file. You must pick good
passwords; access to your private key has legal implications.
You can write these down, but please don't put the passwords
on a post-it note or other public place; keep the passwords
safe! Note, you can also put the passwords as options on the
command line, but generally, that isn't a good idea.
You can view the contents of your keystore with:
keytool -list
Or, if you want the gory details:
keytool -v -list
(To sign your jar file with a real, non-self-signed certificate,
you use keytool to export your certificate data in a form ready
to be signed by some CA. This file is called a "certificate
signing request". You generally email or upload that to the
CAs website, submit proofs of identity, pay them, and some time
later they send back the signed certificate. You can then import
that into your keystore file, and use it the same as the self-signed
certificate.)
7) Now that you have a signed certificate, you can sign your jar file
with it:
jarsigner -signedjar MySignedApplet.jar MyApplet.jar mykey
Check the result:
jarsigner -verify -certs -verbose MySignedApplet.jar
That should be it!
8) To test, move the signed jar file and the HTML file to another
location. (Otherwise, the original package may be found on CLASSPATH,
and your signed jar ignored.)
Don't use appletviewer to test! In older JDKs, appletviewer
defaulted to all-permissions. Now it defaults to "sandbox",
and there is no way to override that, even with signed applets!
"Appleteer" is a non-Oracle alternative that uses "all-permisions".
Probably, best is to test using a web browser.
In the future, you can use the same key and certificate to sign other
jar files (or newer versions of this one). You'll only need to
re-run the jarsigner command.
===========================================
References:
http://docs.oracle.com/javase/tutorial/security/toolsign/index.html
http://docs.oracle.com/javase/tutorial/deployment/jar/signindex.html
http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html
http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jarsigner.html
http://docs.oracle.com/javase/tutorial/deployment/jar/signing.html
http://docs.oracle.com/javase/tutorial/deployment/jar/manifestindex.html
http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#JAR%20Manifest
http://docs.oracle.com/javase/tutorial/deployment/jar/secman.html
https://www.cert.org/blogs/certcc/2013/09/signed_java_applet_security_im.html
http://docs.oracle.com/javase/tutorial/deployment/applet/html.html
https://blogs.oracle.com/java-platform-group/entry/code_signing_understanding_who_and?msgid=3-9171379647
http://pscode.org/appleteer/
--
Wayne