Re: Digital Signature for MIDlet?

On 7/24/07, Ward Willats wrote:
> Motorola certainly does, and with the VeriSign Class 3 PCA too.
>

Really?

There's information about this at developer.motorola.com and based on
my own experience I believe it to be accurate.

In short, you cannot purchase a certificate through Verisign or any
other certificate authority and sign the midlet yourself - it won't
work.  Instead, you need to go through Motorola in order to get this
done, but it will only be done if there is a business relationship
with Motorola and your company.

In any event, a trusted root for SSL is all that is needed in this
case, and finding one of those on a Motorola handset is a much surer
thing.

By the way, I heard Motorola is moving toward JavaVerified for signed
MIDlet support, but I don't know the details.

On 7/24/07, Ward Willats wrote:
> At 07:54 AM 7/24/2007, foo shyn wrote:
> >Thanx for the link. The project would be running in Malaysia and the
> >targeted carriers would be the 3 main telcos in our country.
> >The application would connect through HTTP connection to back end
> >servers to perform transaction / data transfer, and we are thinking of
> >getting it done through HTTPS, which is why i'm looking at SSL.
> >
> >However, Motorola does not support digital signature for MIDlets?
>
> Motorola certainly does, and with the VeriSign Class 3 PCA too.
>
> Generally most recent phones (last couple of years) carry a full load
> of VeriSign root certificates. Some early Samsung and LG device do
> not, or if they do carry them, they may be only made available to the
> WAP browser and not the JVM.
>
> Some carriers (Vodafone) also remove all certs except their own on
> some devices. For example, I have seen Vodafdne Motorola devices with
> only the Vodafone cert.
>
> Even though I work for VeriSign (client development, not certs) I
> agree that it is best not to sign the midlet unless you really need
> access to some proprietary API. You'll have far fewer headaches.
>
> -- Ward
>

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff KVM-INTEREST".  For general help, send email to
[email protected] and include in the body of the message "help".