Security Warning in signed applet

Question

The company I work for has an applet which requires special access to the client machine, so every Jar file is signed digitally. The applet and the company's web application interact using javascript to communicate.

The problem is that the first time the applet is used via javascript, Java throws a Warnign Security popup asking the user to "Allow" or "Do Not Allow" the access to the applet from the website.

I've checked the Oracle's guides to digitally sign applets, to Manifest parameters, but I can not remove the security warning. Also, everytime we test the application, we clear the browser's cache and Java Cache through the Java Control Panel. We work under Windows 7 and 8.

Here is a sample of the Manifest file in the main applet's jar:

Manifest-Version: 1.0
Ant-Version: Apache Ant 1.9.1
Trusted-Library: true
Application-Library-Allowable-Codebase: one.developdomain.net two.developdomain.net *.developdomain.net productiondomain1.net productiondomain2.net productiondomain3.net
Trusted-Only: false
Built-By: My Name
Application-Name: My Application Name
Permissions: all-permissions
Created-By: 1.7.0_45-b18 (Oracle Corporation)
Caller-Allowable-Codebase: one.developdomain.net two.developdomain.net *.developdomain.net productiondomain1.net productiondomain2.net productiondomain3.net
Codebase: one.developdomain.net two.developdomain.net *.developdomain.net productiondomain1.net productiondomain2.net productiondomain3.net

Name: services/xmpp/ChatPanel$4.class
SHA1-Digest: 7On19s6cztysSsrtARTlT5g1R8U=
....

Here is a sample of the JNLP file used to deploy the applet:

<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec="1.0+" href="launch-1.3.4.jnlp">
    <information>
        <title>Application Title</title>
        <vendor>Our Company</vendor>
        <homepage href="http://www.ourdomain.net" />
    </information>
    <security>
        <all-permissions/>
    </security>
    <update check="always" policy="always" />
    <resources os="Windows" arch="x86">
        <j2se version="1.7+" java-vm-args="-Djnlp.packEnabled=false" href="http://java.sun.com/products/autodl/j2se" />
        <jar href="firstjar.jar" version="1.3" download="progress"/>
        <jar href="secondjar.jar" main="true" version="1.49"/>
        ...
    </resources>
    <resources os="Windows" arch="x86_64">
        <j2se version="1.7+" java-vm-args="-Djnlp.packEnabled=false" href="http://java.sun.com/products/autodl/j2se" />
        <jar href="firstjar.jar" version="1.3" download="progress"/>
        <jar href="secondjar.jar" main="true" version="1.49"/>
        ...
    </resources>
    <resources os="Mac OS X">
        <j2se version="1.7+" java-vm-args="-Djnlp.packEnabled=false" href="http://java.sun.com/products/autodl/j2se" />
        <jar href="firstjar.jar" version="1.3" download="progress"/>
        <jar href="secondjar.jar" main="true" version="1.49"/>
        ...
    </resources>
    <applet-desc
        name="My Application Name"
        main-class="main.MainClass"
        width="300"
        height="300"
        progress-class="firstjar.ProgressIndicator">
        <param name="MAYSCRIPT" value="true" />
        <param name="scriptable" value="true" />
    </applet-desc>
</jnlp>

Also, each signed jar file contains the following two special folders and files:

jarfile.jar\
 +-META-INF\
 | +-MANIFEST.MF
 | +-CODESIGN.SF
 | +-CODESIGN.RSA
 +-JNLP-INF\
   +-APPLICATION.JNLP

The digital signature is done with a valid and CA approved certificate, so I am almost sure the problem is not the certificate.

Here is an screenshot of the warning security message:

Security Warning screenshot

Thank you very much for your attention and help.

meriton · Accepted Answer · 2013-12-14T20:16:06.037

5

There is a known issue in the current release of the Java plugin that causes the Caller-Allowable-Codebase attribute to be ignored if the Trusted-Library attribute is also present.

Also, according to my tests the applet must be signed by a trusted certificate for Caller-Allowable-Codebase to be respected.

edited Dec 14 '13 at 20:16

answered Dec 14 '13 at 20:10

meriton

68,356
14
108
175

Huhh.. Thanks for the heads-up. – Andrew Thompson Dec 14 '13 at 21:55
1

Thank you very much. Yes, our certificate is trusted, as in previous versions of our Applet it did work as expected. I thought it was a missing step in the signing process, or perhaps a bad attribute in the Manifest. If the bug is that the "Trusted-Library" causes the Java plugin to ignore the "Caller-Allowable-Codebase" attribute, then I will test using only the "Trusted-Only" attribute, and make sure that all our jars are signed, even the 3rd party Library jars. – David Dec 16 '13 at 16:00
2

I set the Trusted-Only to TRUE, as all of our jars are signed. After this, I removed the Trusted-Library key from our Manifest. It works perfect. Thank you very much for your help, again!. – David Dec 16 '13 at 16:43
I am using java 1.8 and had a similar problem. In my case I have used "Caller-Allowable-Codebase = * ". Instead of * when i use domain name then the problem got resolved. No more Security message. – Prabhakaran May 15 '15 at 16:58

Security Warning in signed applet

1 Answers1