Re: Digital Signature for MIDlet?

On 8/6/07, foo shyn wrote:
> Hi guys,
>
> Well after registered with Verisign i managed to get the certificate and
> installed in my keystore. However when i download the application to my
> phone, it still prompt the untrusted message like it is previously.
> Further checking reviewed that the serial key and fingerprint are
> different from the key on the phone.
>
> After consulting the Verisign support, they mentioned that i'll need to
> import an intermediate certificate to my keystore in order to get it
> working. But after googling through the web and even looking at their
> step-by-step guide, i found that only SSL installation need the
> intermediate certificate, and can't find any info about it on J2ME signing.
>
> Is the intermediate certificate necessary in the code signing process?
> Appreciate it if someone with similar experience can share some limelight.
>
> Thanx
> FooShyn
>

A few questions and suggestions..

Are you sure you imported the whole chain into your store?

Run keytool -list and verify that the signing certificate is a chain
of length 2.

If not, you'll need to import your certificate again, or perform
surgery on your keystore.  I've found IBM's KeyMan to be an invaluable
surgical tool:

http://www.alphaworks.ibm.com/tech/keyman

How are you signing your MIDlet?

The GUIs generally get this right, at least these days.

If you're signing manually using JadTool, then *NOTE* that it
mishandled certificate chains until very recently (I filed the bug
report).  It's fixed in WTK2.5.1 though.

If you're using JadTool you can add certificates explicitly:

java -jar JadTool.jar -addcert alias mykey -keystore keystore
-chainnum 1 -certnum 1 -inputjad in.jad -outputjad out.jad

java -jar JadTool.jar -addcert alias mykey -keystore keystore
-chainnum 1 -certnum 2 -inputjad in.jad -outputjad out.jad

Or, to automatically include all certificates chained to the alias:

java -jar JadTool.jar -addcert alias mykey -keystore keystore
-inputjad in.jad -outputjad out.jad

With either method, the expected result in out.jad is:

MIDlet-Certificate-1-1: <encoded signing certificate>
MIDlet-Certificate-1-2: <encoded intermediate authority>

However, this used to be broken.  In particular, if you tried to add
the chain links explicitly (using -chainnum and -certnum params),
you'd get the first chain link duplicated twice:

MIDlet-Certificate-1-1: <encoded signing certificate>
MIDlet-Certificate-1-2: <encoded signing certificate again>

Or, if you tried -addcert without -chainnum and -certnum, you'd only
see the signing certificate:

MIDlet-Certificate-1-1: <encoded signing certificate>

--Joe

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff KVM-INTEREST".  For general help, send email to
[email protected] and include in the body of the message "help".