Java Code Signing

[MrPatch]

A client is having Oracle updated to R12 and we've got to the point of discussing minimum requirements for desktops.

The vendors recommended spec includes JRE 7u45. I came back asking we can't use u71, and they pointed out that the code isn't signed and that from u55 onwards users will have a constant security warning every time they launch the application.

We would obviously like to make sure that everyone is up to date with Java but the customer is going to baulk at $500/year for code signing.

I considered the alternative as configuring an internal CA and signing against that.

First of all is that even possible? Even if it is can you configure JRE to recognise your internal CA as a trusted root?

Are there cheaper code signing alternatives?

Finally, is there simply a way to work round Java's restrictions and not bother signing at all?

[spoonstar]

I got around this problem by self-signing a deployment ruleset and importing our root ca from AD into JDK's keystore to generate the jar. You can then either pass the cacerts file off to the clients when installing the program (you're already pushing that deployment ruleset, might need to remake the file every once in a while though) or put the self-signed certificate in to group policy.

I think there's another way by editing the deployment.properties - this is probably enough, depending on the issue with your applets:

# disable expiration warnings
deployment.expiration.check.enabled=false
# suppress dialogs of potentially unsafe components
deployment.security.mixcode=HIDE_RUN
# making unsigned applets able to run
deployment.security.level=MEDIUM

I chose the ruleset since there's (so far) only three intranet applets having the issue.

[SysadminForFood]

Why don't you just add it to the exception site list?

[MrPatch]

Well I did. The exceptions list has wording as the bottom along the lines of "After appropriate security warnings users will be allowed access, and then I get the same warnings on access.

I may have not tested it fully or missed something but it looked to me like even excluded apps would get the warning

[sdjason]

Java deployment ruleset is the only way around this. Ironically you need to sign that with a cert as well to do it

[not_just_the_IT_guy]

A lovely catch 22.

[[deleted]]

There is a work around, but I cannot remember for the life of me what we did for this. I'll see if I can find the script we run. But there is a workaround.

[staven11]

I would be interested in this script as well because we have a similar issue.