## 10.02.2016 AK
----
 [[JavaCodeSigningTest/CZ|česky]] | '''english'''
----
= JavaCodeSigningTest =

Here is a comparison of java codesigning with CAcert and freemail Thawte certificates, timestamping provided by Certum.pl see TimeStamping but note that the Certum timestamping CA cert needs to be added to the Java runtime keystore by the user. For an alternative timestamping method not requiring user involvement see JavaTimeStamping.

We have created 4 certificates and tested them on 4 copies a jar file using java keytool.

|| Certificate provider || type of certificate || test result || URL ||
|| CAcert || client + codesigning || OK (needs "cacerts" file updated to work flawlessly) || http://www.tiebogos.fr/pasta ||
|| CAcert || client               || cannot verify signature || http://www.tiebogos.fr/broken_pasta ||
|| Thawte || freemail            || cannot verify signature || http://www.tiebogos.fr/broken_pasta_thawte ||
|| Thawte || freemail + codesigning (no extensions) || OK (works seamlessly) || http://www.tiebogos.fr/pasta_thawte ||

So email-only certificates do not allow a proper java codesigning, you need codesigning ability in the certificate to sign java files !

/!\ As of november 2009, Thawte freemail program and java codesigning has been discontinued.

In case you need, please contact guillaume (at) cacert.org

here are the signed jars as of Nov 25th 2007 :

[[attachment:pasta1.jar]] 
[[attachment:pasta2.jar]]
[[attachment:pasta3.jar]]
[[attachment:pasta4.jar]]

Here are the details of the tests (basic details of the certs, signature of the jars, verification of the signature of the jars)  :

{{{
*******************************************************************************

SIGNATURE WITH TIMESTAMPING (CERTUM.PL service)

*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -storetype pkcs12 -keystore gr_CAcert_CS_free.fr_19_11_2007.p12 -tsa "http://time.certum.pl/" pasta1.jar "guillaume frederic romagny's root ca id"
Enter Passphrase for keystore:
*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -storetype pkcs12 -keystore gr_CAcert_free.fr_19_11_2007.p12 -tsa "http://time.certum.pl/" pasta2.jar "guillaume romagny's root ca id"
Enter Passphrase for keystore:
Warning:
The signer certificate's ExtendedKeyUsage extension doesn't allow code signing.
*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -storetype pkcs12 -keystore gr_thawte_free.fr_19_11_2007.p12 -tsa "http://time.certum.pl/" pasta3.jar "guillaume romagny's thawte consulting (pty) ltd. id"
Enter Passphrase for keystore:
Warning:
The signer certificate's NetscapeCertType extension doesn't allow code signing.
*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -storetype pkcs12 -keystore gr_thawte_CS_19_11_2007.p12 -tsa "http://time.certum.pl/" pasta4.jar "golfromeo"
Enter Passphrase for keystore:
*******************************************************************************

TESTING SIGNATURE

*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -verbose -verify -certs pasta1.jar

jar verified.
*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -verbose -verify -certs pasta2.jar

jar verified.
Warning:
This jar contains entries whose signer certificate's ExtendedKeyUsage extension doesn't allow code signing.
*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -verbose -verify -certs pasta3.jar

jar verified.
Warning:
This jar contains entries whose signer certificate's NetscapeCertType extension doesn't allow code signing.
*******************************************************************************
[gr@gr codesigning_11_2007 0/0]$ jarsigner -verbose -verify -certs pasta4.jar

jar verified.

}}}

----

 . CategorySoftware