Comments on: Techie help needed re Java mobile certificates

By: jorgeavilam

jorgeavilam — Mon, 30 Mar 2009 21:20:45 +0000

You should talk to Verisign.

By: jorgeavilam

jorgeavilam — Mon, 30 Mar 2009 15:20:45 +0000

You should talk to Verisign.

By: Rich Hyndman

Rich Hyndman — Tue, 18 Dec 2007 11:48:56 +0000

Hi,

I’m also happy to help out on this if Daniel still needs a hand. I’ve done it before with Mobizines, compiling up MIDlets on a server with varying content inside them and then getting the server to sign them. Tricky bits are making sure you have the entire certificate chain inside the JAD file – linking your certificate to the Certificate Authority’s root certificate and (as Kieran says) making sure you only deliver the signed application to phones which have the root Certificate Authority’s certificate installed on them. For ‘trusted 3rd party’ we were using a Verisign Class 3 Code Signing certificate and found that only Sony Ericsson devices consistantly had the root CA installed. Newer devices (last 1-2 years) from many manufacturers do have the certificate installed but it is a hassle testing each device and maintaining a list of which Nokia’s/LG’s/Samsung’s/… do have it and which don’t.

That is where Java Verified came in as they maintain a list on JavaVerified.com of which devices definitely have the JavaVerified root certificate on them, but then that is expensive and you can’t self-sign.

Kind regards
Rich

By: Ewan

Ewan — Mon, 17 Dec 2007 19:37:06 +0000

Kieran, I talked to Daniel and he’s away to talk to VeriSign — thanks for taking the time to answer!

By: Kieran

Kieran — Mon, 17 Dec 2007 11:44:01 +0000

further to this point as he is recompiling on the fly he is going to have to use a verisign certificate as he needs to be able to self sign the application

By: Kieran

Kieran — Mon, 17 Dec 2007 10:57:03 +0000

Unsigned Java applications are placed into what is known as third party untrusted

There are 4 groups for security, all remove the particular nag Dan has a problem with except the first

Third Party untrusted (basically an unsigned application)
Third Party Trusted (Verisign/ Java Verify)
Operator (Vodafone, T Mobile etc)
Manufacturer (Sony, Motorola etc)

Signing applications also allows access and/or removes the nags to protected apis such as JSR 75, http connection.

The big stumbling block here is you cannot be certain which certificates are on a given phone, the most common ones are the Java Verify programme’s (in the phone as UTi) and the Verisign certificate, however for example not all Motorolas will have the Verisign certificate. Most Sonys do but if we take the Vodafone UK K800 this only has the Java Verify certificate

Hope the above helps feel free to contact me if you wish further clarification