Thread: Running unsigned (Java) applications like this will be blocked in a future release

Hi

I have a website that I had built about 8 years ago and uses a java applet for plotting graphs. I did the original programming of the applet for my first site and then professional programmers took my coding and incorporated it into the current site 8 years ago. The site is database driven and works very smoothly and is providing very specialized data to very large US utility companies.

With the recent upgrade of Java, I now get a message saying

"Do you want to run this application An unsigned application from the location below is requesting permission to run."

"Running unsigned applications like this will be blocked in a future release because it is potentially unsafe and a security risk"

"click Cancel to stop this app or Run to allow it to continue."

I guess this means that I'm going to have to get my java applet signed. I haven't really got much idea how I should go about this, could someone give me some pointers? Do I need to buy a digital signature? I notice there seem to be different levels of signature, can someone please advise what I would need?

Thanks for your help.

Pavesa

I recommend you do a simple search, something like "java applet signing", and notice the topics that come up, everything from how to do it, why you should/shouldn't etc., and become smarter on the whole topic. After you've gotten smarter, THEN decide what to do.

Hi

thanks for the thoughts.

I think I'm getting a few thoughts together on this. An issue I'm not sure about is that my website it owned by a company "ABC" and I'm wondering whether the digital certificate needs to be owned by ABC or a domain name registered to ABC or whether I can own it myself. Conceivably, checks could be to ensure that the certificate is registered to the domain name or its owner. I'd prefer to own it myself if possible. Does anyone know this? I would have guessed that just a signed java applet would be enough to satisfy java to run happily without popup warnings..

Thanks

Pavesa

Hi Aussiemcgr

thanks for the insight on this, I really appreciate it.

Pavesa

Hi

from what I read, I need to use Jarsigner to sign and time stamp my JAR files. Can anyone tell me where I can get this? I found the instructions on Oracle's website but no link to get hold of the software. Is it part of the JDK?

Thanks..

Well, hopefully I just have to do this once in the next X years, so I'm gonna try the Jarsigner. Thanks for the info..

I've been doing a bit more investigation on this and I've found I don't seem to have a .jar file on my site. I'm using a product called RChart (excellent by the way) and there are *.java files. Anyone happen to know if this file is the equivalent of the *.jar file?

Thanks for your help..

Pavesa

Hi Aussiemcgr

I seem to have unpackaged class files in the page that generates the chart. Eg

APPLET id="Applet1" codeBase="./" height="500" hspace="0" width="700" align="middle" code="com.charting.mychart.ChartApplet.class"
vspace="0" name="TestApplet" VIEWASTEXT>

Looks like it runs ChartApplet.class outside a JAR file. It was built in visual studio and the start of the page refers to

Inherits="Website.PlotGraph"

which looks like it refers to a DLL called Website.dll in the bin folder

The site works, so I have to say it is possible but I wonder if in this scenario there is no Jar file?

I really appreciate the advice on this

Pavesa



Is that possible?

Andrew

How can a class be outside JAR (Java Archive) ?
Every class are packaged to Jar. I wonder about what you saying..

Hi

I made this post about 3 weeks ago and have been digging away getting my code signing cert and now starting to look at signing the Java. As mentioned above, there currently is no .Jar file on the site so I split the task into 2 parts just the .class files etc

1) Get a .Jar working

2) Sign the working Jar

Unfortunately, I don't seem to yet to have succeeded with (1) and I'm wondering if this is something to do with the site having been built (professionally) in Visual Studio and maybe this integrates Java and digital certificates in a different way. The site was probably built about 8 years ago and unfortunately the firm that built it died during the crisis so I can't talk to them. I notice there is a folder called "bin" with a .dll in it called MySite.dll and although I can't read most of it, when I open the file with wordpad I can see the word "PublicKeyToken" which makes me wonder whether both Java and digital certs need incorporating through Visual Studio. Any help on this much appreciated!

Hi Norm

thanks for the feedback. Currently I don't have a manifest file on the site - the Applet I have works fine although it's probably about 10 years old so maybe it pre-dates manifests.. Is a manifest necessary to do the code signing?

Hi Norm

thanks very much for the info, that does take the manifest side out of the equation.

So that just leaves me wondering whether sites built with Visual Studio have different procedures for running Java (with or without .Jar files) with the Java integrated via the MySite.dll in the bin directory and similarly if code signing is done via that MySite.dll or whether Java and code signing are just stand-alone on with a Jar file like any other website. Does anyone happen to know?

It's probably evident from the wording of my posting that this is all almost entirely outside my experience/knowledge, so I really appreciate the sign pointers you're giving here..

Hi Norm

thanks for the posting. I think I mis-explained. The website has a .dll file and I assume this is produced by Visual Studio because it's been there ever since I had the site built. My speculation is that Visual Studio integrates/links (somehow) all sorts of functionality into this .dll (in the bin folder) such as the "Jar" functionality and maybe also the whole code signing side. Just wonder if anyone knows. The Jar file doesn't contain the .dll, I'm speculating that the .dll somehow contains the Jar file itself or maybe its functionality..

Hi

I've made a bit more progress. The site uses ASP.Net and has a bunch of .resx files so it looks like the site has a satellite dll to bring everything together.

As an experiment, I removed all the class files and uploaded to the root director a jar file that I have with my charting Java applet. I'm getting a ClassFormatError

"Incompatible magic value 1008813135 in class file com/java4less/rchart/ChartApplet"

I tried googling this and it seems to be associated with trying to load something that the server doesn't know as noted here

From http://stackoverflow.com/questions/2390733/incompatible-magic-value-1008813135>
0xCAFEBABE is the usual first 4 bytes of a Java file.
1008813135 is <!DO in Latin encoding, which is, in all probability, the start of <!DOCTYPE....
It is therefore likely the start of a 404 error, or some other error page from the server
ie. You may be trying to load something that the server doesn't know.

Does anyone have any thoughts? I wonder if I can sign the class files individually rather than try and get the site working on a Jar file and then sign that. I don't know if that's possible.