OraTransplant

Importing self-signed certificates in Sun JPI

5 September 2005 at 09:57 CEST | In Forms, Oracle, SUN JPI/JVM, Signing and certificates |

As you might now from other blog entries, we’re running Oracle Forms using Sun’s JRE/JPI and not JInitiator. We’re using commercial certificates for some of our webservers, but we’re also using some self-signed certificates for our development/test server and for code signing. Up until now all users where presented with a warning about these “invalid” certificates by Sun’s JPI.

I tried before to import our self-issued certificates in Sun’s keystore, but I never managed to get it working. It was allways asking for the keystore password, and I couldn’t find anywhere what the default password for such a keystore would be. Lukelly I found it today on the internet and the default password is "changeit". That’s probably some good advice

I’ve blogged before about importing certificates in JInitiator. You could read there that we are using oracle Certificate Authority to create our own certificates. The advantage to that is that all self-issued certificates are “children” of our self-issued root certificate. This gives me the advantage that I only have to import this root certificate in a browser/JVM and not all certificates that were created of this root certificate.

You could export the certificate from OCA, or you can just get it from Internet Explorer. Just visit a HTTP site that uses the certificate and double-click on the yellow lock in the status bar. Go to the Certification Path tab and double-click the root certificate to open it. No go to the Details tab. If you do not have a self-issued root certificate you can just start of at the Details tab of your initial certificate. Click on Copy to File and save the certificate in base64 encoding.

Now open a command box and change your working directory to the lib\security subdirectory of your Sun JPI. Then execute the keystore command to import your certificate:

C:\>cd "\Program Files\Java\j2re1.4.2_09\lib\security"

C:\Program Files\Java\j2re1.4.2_09\lib\security>..\..\bin\keytool
   -import -file "c:\temp\self.cer" -keystore cacerts
   -storepass changeit -alias myRootCA
Owner: O=Eurotransplant International Foundation, C=NL
Issuer: O=Eurotransplant International Foundation, C=NL
Serial number: 1
Valid from: Mon Feb 21 08:59:26 CET 2005
   until: Thu Feb 19 08:59:26 CET 2015
Certificate fingerprints:
         MD5:  **:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**
         SHA1: **:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**
Trust this certificate? [no]:  yes
Certificate was added to keystore

Now, when you try to start your Oracle Forms application the applet will no longer complain about untrusted certificates for SSL communication. It will still ask the user to accept the Java applet as it is trying to run outside its sandbox. You cannot get rid of this message, as it is by design that Java will ask the user permission for an applet to run outside its sandbox.

The applet as shipped by Oracle is signed by “Developer/Oracle” and uses a self-issued certificate. If you want to get rid of this, you’ll have to re-sign the JAR file yourself with your own certificate. For more information see another blog entry.