June 2006
M T W T F S S
« May   Jul »
 1234
567891011
12131415161718
19202122232425
2627282930  

Recent Posts

Recent Comments

Ads


« Tango | Main | Switching Servers! »

MIDlet jar signing (a tutorial) Revised

By dave | June 18, 2006


It’s been a long time since the original MIDlet jar signing (a tutorial) and it’s about time I collated all the feedback into a revised tutorial. Let me know what you think.
Get required software
  1. Java SDK (JDK) from Sun (you should already have this)
  2. Java Wireless Toolkit (WTK) also from Sun
  3. Optionally get and install Ant and Antenna to allow you to automate your build (I’d strongly recommend these)
Import an existing certificate (if you have one)
  1. If you’ve purchased a certificate from Verisign (or another provider) you need to import the certificate into your J2SE keystore.
  2. Try using the following command keytool -import -alias {myalias} -file {mycertificate} (I haven’t been able to test this since I don’t have a proper certificate)
  3. Run keytool -list to see your new certificate
  4. Next you must export the certificate so you can import it to your phone
  5. Run keytool -export -alias {myalias} -file mycertificate.crt
  6. Import the certificate into your phone (see below for details)
Create and import a new (test) certificate
  1. You need to use keytool (from the JDK)
  2. I used the following command keytool -genkey -alias {myalias} -keyalg RSA -validity 365
  3. This will prompt you for a keystore password, enter your keystore password (if you have an existing keystore) or the one you want to use if you don’t have one yet
  4. Fill in all the prompts about location/company name etc.

    C:\j2sdk1.4.2_08\bin>keytool -genkey -alias company -keyalg RSA -validity 365
    Enter keystore password: password
    What is your first and last name? [Unknown]: My Name
    What is the name of your organizational unit? [Unknown]: company
    What is the name of your organization? [Unknown]: company
    What is the name of your City or Locality? [Unknown]: location
    What is the name of your State or Province? [Unknown]: location2
    What is the two-letter country code for this unit? [Unknown]: GB
    Is CN=My Name, OU=company, O=company, L=location, ST=location2, C=GB correct? [no]: yes
    Enter key password for (RETURN if same as keystore password):

  5. Run keytool -list to see your new certificate
  6. Next you must export the certificate so you can import it to your phone
  7. Run keytool -export -alias {myalias} -file mycertificate.crt
  8. Import the certificate into your phone (see below for details)
Build and package the application
  1. Use javac to build your MIDlet paying special attention to your classpath and bootclasspath options (otherwise preverification will fail). I also set target to 1.1 and source to 1.3
  2. Generate your JAD file the critical attributes in the JAD are MIDlet-Jar-URL, MIDlet-Jar-Size, MIDlet-Permissions we also included MIDlet-Icon, MicroEdition-Configuration, MicroEdition-Profile, MIDlet-Name, MIDlet-Push-1, MIDlet-Icon, MIDlet-Description and MIDlet-Version
  3. Generate the MANIFEST.MF file based on your JAD, you must remove MIDlet-Jar-Size and MIDlet-Jar-URL
  4. Both these tasks can be completed using the wtkJad Antenna task
  5. Package and preverify the app using the wtkPackage Antenna Task you must set the classpath and bootclasspath properties correctly otherwise Preverification will fail
Sign the application
  1. Sign the Application using jarsigner
  2. Run jarsigner -keystore {mykeystore} -storepass (mypassword} {myjar} {myalias}
  3. Now you have a signed jar you need to update the MIDlet-Jar-Size in your JAD
  4. Now add the certificate to the JAD using JadTool.jar from the WTK
  5. Run java -jar JadTool.jar -addcert -alias {myalias} -storepass {mypassword} -keystore {mykeystore} -inputjad {myinputjad} -outputjad {myoutputjad}
  6. Now add the signature to the JAD again using JadTool.jar
  7. Run java -jar JadTool.jar -addjarsig -alias {myalias} -jarfile {myjar} -storepass {mypassword} -keypass {mypassword} -keystore {mykeystore} -inputjad {myinputjad} -outputjad {myoutputjad}
Deployment
  1. Deploy this to a web server with the MIME types set correctly and download it to your phone and it will be a trusted 3rd party application
  2. You can also deploy applications to phones by sending the JAR & JAD to the phone over Bluetooth or Infrared or a cable depending on your phones features. On Nokia phones the files
    appear in your SMS Inbox
Installing the Certificate on the phone
  1. Import the certificate into your phone, in Windows XP SP2 I could do
    this by right clicking the file and selecting "Send to Bluetooth Device",
    you should be able to send files by cable or Infra Red (IR) too. NB: I
    haven’t found anyway of importing a certificate on a Series 40 phone
  2. Once the certificate is installed it needs to be authorised for
    "Application Installation". On my phone (Nokia 6680) this is under
    Tools->Settings->Certificate Management->Trust Settings, I turned on
    everything but I think "Application Installation" is all you need
Common Problems
  1. Application not installed using the JAD: The application is only trusted if it is installed using the JAD, the application will still install from the jar but it won’t be trusted.
  2. Application trust settings not set: Once your application is installed you need to specify how much trust to give it (it doesn’t get all permissions by default). On a Nokia Series 60 phone these are found under the App. Manager.
  3. Root certificate missing from phone: The Java Verified certificate and/or Verisign certificates are missing from some phones check under Tools->Settings->Certificate Management for the relevant certificate
  4. Authorization Failed: - There are a whole host of possible reasons behind this here are the ones I’ve come across
    1. Certificate missing from phone, double check your certificate is installed and has been marked as trusted for application installs in Certificate Management
    2. Reboot: Uninstall the application completely then reboot your phone try taking the battery and SIM out too, often things get themselves in a twist, especially if you’ve been re-installing a lot without uninstalling first
    3. JAD/JAR mismatch: Double check the application size in the JAD, remember it’s the number of bytes that is important NOT the size on disk
    4. Browser cache: If you’re installing over the air make sure you clear your browser cache before installing
    5. I’ve heard but not verified that line breaks in the MIDlet-Permissions can cause problems but it seems ok to me on Nokia 6680/6630/6230i (could be firmware dependent?)
    6. The MIDlet-Permissions attribute is the cause of a lot of problems (especially since the documentation is often wrong/missing or different depending on the phone), try leaving it out first and add permissions in one at a time. Some phones will complain about permissions they don’t support, some will ignore them
  5. There is a bug in some early Nokia 6600 firmwares that stop the install of trusted MIDlets
  6. Certificate not valid yet: If you generated the certificate yourself it may have a start validity date of tomorrow, also if your PC and phone dates are different you may be outside the period of validity of the certificate
  7. No certificate management on Series 40 phones, you can install a signed application but behavior is strange with self signed certificates
  8. JadTool problems: I haven’t experienced any of these issues but lots of other people have
    1. "I have issues if I try to use the jadtool manually. I have a certificate chain and can’t seem to get the second certificate added to the JAD file using any WTK jadtool. The interesting part however is that I can successfully sign the midlet using any of the same WTK GUI interfaces - they add the second certificate correctly. My steps:
      1. Use 1.4.2_06 jarsigner.exe to sign jar
      2. Use WTK (2.2 or 2.3 beta) jadtool to addcert with certnum 1
      3. If I call jadtool to addcert with certnum 2 the same certificate is inserted as cert 1-2 I’m assuming I am doing something incorrectly since the WTK gui seems to be working just fine"
    2. "I received a post on the KVM news group on the topic that states there is a bug in the jadtool and the author claims to have filed a bug report and posted a patch: http://archives.java.sun.com/cgi-bin/wa?A2=ind0508&L=kvm-interest&F=&S=&P=9858 One interesting note that was also posted was that the cert JAD params are static so once you get them from the WTK correctly you can put them statically in the ant script."
    3. "I am trying to sign a MIdlet for Nokia 6620 device. I am using a Verisign Code Signing certificate that actually contains two certificates (User and Intermediate CA). I am using the WTK 2.2 signing tool. Do you know if this tool support two certificates when signing ? The signature is added to the JAD file with two certificates but I have been getting security error when installing. I have checked on the device and there are different root certificates installed for Verisign but it still fails !
    4. "If you want, you can download the sprintpcs developer kit as it supports dual certs (http://developer.sprintpcs.com). However, I never got that cert to work on the Nokia (6620/cingular) phone, although it does work on sprint phones (with developer root enabled). Ultimately, I only got things to work by creating the cert as described in this blog and installing that on the phone. Bizarrely, even though the root cert for my versign-signed cert *was* on the 6620 phone, it still would never install my MIDlet as you would think it should."
  9. Old phones (6230/i, 6682) don’t support x509 certificates, WPKI has been suggested as a possible solution but I haven’t investigated this
  10. Socket connections can be problematic (http://discussion.forum.nokia.com/forum/showthread.php?t=68306 ) possibly due to the WAP infrastructure and the services provided by an operator. HTTP is a much safer protocol to use
  11. "Go online and check application validity": Yes/No. If I click on yes button the phone I get the following error: "Certificate revoked for this application" and the installation fails. To rectify this go to Tools -> Manager -> Menu -> Settings -> Online Certif Check [ On / Off / Required] There is also a Default address setting. If the online control setting is required, the check will fail, if there is no default address. see http://discussion.forum.nokia.com/forum/showthread.php?t=71071
Trust Domains
  1. There are 4 different trust domains in MIDP2 (manufacturer, operator, trusted third party, and untrusted). Trusted Third Party is the only one of any use to us really.

    It gives the following options on my Nokia 6680 (Vodafone UK):

    Network Access: Not Allowed, Ask every time, Ask first time
    Messaging: Not Allowed, Ask every time App
    Auto-Start: Not Allowed, Ask every time, Ask first time
    Connectivity: Not Allowed, Ask every time, Ask first time, Always allowed
    Multimedia: Not Allowed, Ask every time, Ask first time
    Read User Data: Not Allowed, Ask every time, Ask first time, Always allowed
    Edit User Data: Not Allowed, Ask every time, Ask first time, Always allowed

  2. These settings are defined by the operator and the phone manufacturer and therefore vary between phone, manufacturer and operator.
Unresolved Problems
  1. I managed to sign the JAD with this format using J2ME WTK utilities, but when trying to install it on the device I get a message "Application authentication failed 909".
Sample JAD

MIDlet-Jar-URL: MyApp.jar
MIDlet-Jar-Size: 201365
MIDlet-Name: MyApp
MIDlet-Vendor: EC1M
MicroEdition-Profile: MIDP-2.0
MicroEdition-Configuration: CLDC-1.1
MIDlet-Icon: logo.png
MIDlet-Push-1: sms://:6553,net.ec1m.MyApp.midp.MyAppMIDlet,*
MIDlet-Description: MyApp MIDlet
MIDlet-Permissions: javax.microedition.io.PushRegistry,javax.microedition.io.Connector.sms…
MIDlet-Version: 1.0.67 MIDlet-1: MyApp, logo.png,net.ec1m.MyApp.midp.MyAppMIDlet
MIDlet-Certificate-1-1: MIICODCCAaECBEKqpfswDQYJKoZIhvcNAQEEBQAwYz…=
MIDlet-Jar-RSA-SHA1: EUsAch/…/hEZOsJsiCjBOhNs/3FSw4=

Sample Manifest

Manifest-Version: 1.0
MIDlet-Name: MyApp
Created-By: 1.4.2_05-b04 (Sun Microsystems Inc.)
MIDlet-Push-1: sms://:6553,net.ec1m.MyApp.midp.MyAppMIDlet,*
MIDlet-1: MyApp, logo.png, net.ec1m.MyApp.midp.MyAppMIDlet
MicroEdition-Configuration: CLDC-1.1
Ant-Version: Apache Ant 1.6.2
MIDlet-Icon: logo.png
MIDlet-Vendor: EC1M
MIDlet-Permissions: javax.microedition…
MIDlet-Version: 1.0.67
MicroEdition-Profile: MIDP-2.0
MIDlet-Description: MyApp MIDlet

Sample Ant Build File

I’ve put our EC1M ant build file up on our website to (hopefully) make all this a little easier for you.

Other Resources

This FAQ on the Nokia Forum is worth a read. (Thanks chortya for the link)


Tags: none
Topics: /Technology |

71 Responses to “MIDlet jar signing (a tutorial) Revised”

  1. LaiChung Says:
    July 17th, 2006 at 11:54 pm

    Dear David:
    About your “Unresolved Problems” , this is because you have not create a RSA SHA-1 signature of the JAR. You can find the detail about the install verification process of the jar file from this website : http://www.iua.upf.es/~mkalten/teaching/sysintII/midp20/javax/microedition/midlet/doc-files/PKITrust.html

  2. LaiChung Says:
    July 17th, 2006 at 11:56 pm

    And for those user using latest motorola phone, i have to tell you a bad news. After a deep investiage of the files inside the phone firmware (as you may know , those files inside ……/kjava is the cert. file and the most important file “j2me_domain_registry.sm” is the registry file), you should have NO WAY to install your own cert for verify your jar file or install your jar file signed by your own created cert. The reason is , j2me_domain_registry.sm is a file stored information about which root CA is allowed for verify the signing of a jar. I check and disassembled that file already, the very bad news is you can’t change the content of that file since it is signed by motorola CA. (Actually the structure of the file is simple, but it is meaningless since we cant change the content of it.)

  3. Anonymous Says:
    July 31st, 2006 at 5:47 pm

    >Unresolved Problems
    >
    > 1. I managed to sign the JAD with this
    >format using J2ME WTK utilities, but when

    >trying to install it on the device I get
    >a message “Application authentication >failed 909″.

    I had this error for a while, and it was down to having a couple of certs on the phone that had the same DN string. Had to delete them both and reinstall the correct one.

  4. joebowbeer Says:
    August 9th, 2006 at 2:57 pm

    JadTool is fixed in WTK 2.5 Beta

    http://archives.java.sun.com/cgi-bin/wa?A2=ind0607&L=kvm-interest&P=R498&I=-3

  5. DK Says:
    October 3rd, 2006 at 11:22 pm

    Hi,

    I am struggling to understand one simple thing: What exactly does a 3rd Party domain certificate achieve for the Midlet?

    Does it:
    a) remove the “untrusted midlet. install?” message at the OTA download?
    b) remove the “application wants to send/receive data from the network. is this ok?” message when HTTP of UDP is used?
    c) remove the “Ask Once, Ask every time…” message?

    cheers
    DK

  6. Raj Says:
    October 10th, 2006 at 4:35 am

    Thanks for tutorial.

    Some queries:

    1. What all companies provide certificate to sign midlets?
    2. Will this process work for Nokia N and E series phones (Symbian 9.1 OS)? Or we need to talk to javaverified?

  7. David Hayes Says:
    October 11th, 2006 at 5:48 am

    Hi,
    This process should work fine on Symbian phones. I’d recomend this process for development testing only. If you need to market the application I think Java Verified is a good idea

  8. David Hayes Says:
    October 11th, 2006 at 5:51 am

    The short answer to what a third party trusted certificate gives you is “it depends”. In our case we removed the prompt evertime we accessed the addressbook. You can usually relax the security settings on a signed app but it all depends on the phone and carrier. Usually you can’t turn off prompts if it will cost the user money

  9. chortya Says:
    October 11th, 2006 at 9:57 am

    Thnx for tutorial. But it doesn’t seem to work on s60 3rd (Symbian 9.1) :( Self-generated certificate isn’t accepted by the phone for applications installations, it’s restricted to ¨normal¨ internet certificate usage, only ¨Internet¨, ¨Online checking¨ options are available in certificate management settings. I’ve also found an explanation <a href=”http://discussion.forum.nokia.com/forum/showthread.php?t=85660″>here</a>
    <br><blockquote>Q: Can I use a certificate and key created by me to sign my midlets?<br>

    Yes, you can run a midlet signed with a certificate created by you on emulators. Self-signing does not work on Series 40 devices nor S60 3rd edition devices.¨
    </blockquote>
    Let’s hope there will be some workaround…

  10. David Hayes Says:
    October 12th, 2006 at 1:20 am

    What a pain, it’s certainly ok on Series 60 2nd Edition devices (6680, 6620 etc) begs the question how are you meant to test apps if you can’t test sign them

  11. HyperDice Says:
    October 14th, 2006 at 8:14 am

    Hi everyone,

    i followed the tutorial above and created my own certificate. But when I try to install it on my device (Sony Ericsson K800i) it says “invalid certificate”.
    Is there a way to get a self signed certificate running on a K800i??
    I hope you can help me…

    Thx,
    HD

  12. Michael Says:
    October 16th, 2006 at 4:42 am

    For Motorola handsets it seems you have to use their Development MIDlet Signing Process. Swing by http://developer.motorola.com/ and search for that phrase after signing up to see the process they require you to go through in order to make it work.

  13. Joel Says:
    October 17th, 2006 at 10:20 am

    I’m having a problem whenever I try to load my signed application. I got a signature from verisign (class 3 digital ID), however even after going through the steps outlined above (with no errors reported) and loading onto the phone, I still get an authentication error; specifically, on the LG LX350, I get the error “909 Application Authentication error.” I have tried other devices as well, and none of them have worked…<br /><br />

    So, some questions:<br />
    1. Will the signature I received from verisign work? I know that a few of the phones I’ve tried this on support verisign certificates but maybe I got the wrong class? <br />
    2. Is there anything special I need to do to OTA this application? I’ve been able to download it unsigned and it works fine.<br /><br />

    Thanks in advance for the help.

  14. Mike Roberts Says:
    October 19th, 2006 at 5:19 pm

    Is there any easy way to validate the integrity of the jar in java to check the signatures in a jad are still valid? The reason I ask is I am attempting to automate some of this in a little tool to make my life easier and I want to be able to validate the finnish jad / jar before i waste time testing OTA?

  15. Pronto Games Says:
    October 20th, 2006 at 3:14 pm

    <p>Thanks for setting this&nbsp;up David, I’ve already found lots of useful information here.<br />
    <br />
    I am experiencing the same problem that Joel is - 909 App Authentication error, on the Sanyo 7400 (sprint).&nbsp; Both the jad and the jar have been signed, and&nbsp; I’ve followed the steps listed here without error with one exception: I have not installed the certificate on the phone.&nbsp; I’ve searched the Sprint developer page looking for ways to do this, but&nbsp;I only&nbsp;found steps for the windows smart mobile phones.&nbsp; I haven’t found any way to do this on standard OTA deployments.&nbsp; The technical director for the company hiring us to do this says that as far as they know there is no cert put on the phone explicitly, that midp2 does this itself.<br />
    <br />
    So my questions are:<br />
    1) Do I need to place the certificate on the phone for OTA deployment?<br />
    2) If so, how do I do this?&nbsp; If not, is there something special that needs to happen for OTA deployed jars to get authenticated?&nbsp; I’ve tried several signing methods (command line, WTK2.0 gui, sprint’s launchpad) and none of them have worked.&nbsp; Any clues you can give me will be greatly appreciated.&nbsp; Thanks for your consideration.</p>

  16. Pronto Games Says:
    October 23rd, 2006 at 10:04 am

    I negelected to mention in my first post that I enabled developer root on the phone.&nbsp;&nbsp;Assuming we can trust the sprint webpage the phone should be good to go, so that isn’t the problem.

  17. Pronto Games Says:
    October 24th, 2006 at 4:23 pm

    <p>I’ve used jarsigner to verify the jar.&nbsp; It said my jar was valid even though I still get 909 Authentication errors, so I can’t say exactly how useful it is, but it at least told me my certificate was still valid and gave me the expiration date.&nbsp; The syntax is like this:<br />
    <br />
    &lt;span class=”HTML-0020Code–Char”&gt;C:\jdk1.3\bin\jarsigner -verify -verbose -certs d:\TestApplet.jar&lt;/span&gt;</p>

  18. SoulRebel Says:
    October 24th, 2006 at 11:01 pm

    Do you think some sort of hacking could be made to substitute one of the present certificates with your own on a motorola phone? I had the idea of placing my custom certificate over the &amp;quot;operator&amp;quot; certificate, without modifying the domain registry file. This could work, although is not a valid solution for distributing your apps to the world.

  19. Pronto Games Says:
    October 25th, 2006 at 9:15 am

    bah stupid html.&nbsp; Lose the span stuff, this is the call:<br />
    C:\jdk1.3\bin\jarsigner -verify -verbose -certs d:\TestApplet.jar<br />
    <br />
    Teach me not to preview…

  20. Cecchi Says:
    November 16th, 2006 at 10:58 am

    Why everytime I reinstall application on my Nokia 6630 I must redefine all application trust settings under the App. Manager? Does a manner exist to do this one time forever?

  21. Rek>pth Says:
    December 3rd, 2006 at 11:29 pm

    Hi, David!

    Could You describe the contents of j2me_domain_registry.sm file for latest Motorola phones, please? I have 2 such files, and for 1st one there is no any rights for unsigned midlets, but for 2nd there are some rights.

    Bst rgrd, Rek&gt;pth

  22. David Hayes Says:
    December 10th, 2006 at 5:13 pm

    <p>Hi, I’ve never come across one of thes files. Perhaps somebody else who reads this can help??</p>
    <p>Dave</p>

  23. Fahd Sultan Says:
    December 21st, 2006 at 10:23 am

    Hello !<br />
    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; I have followed your tutorial and have successfully signed my midlet and installed but I still get &amp;quot;Allow this application to send SMS?&amp;quot; popup what am I doing wrong? I have Nokia 3230.

  24. Raja Nagendra Kumar Says:
    December 27th, 2006 at 9:55 pm

    <p>Hi,</p>
    <p>We are seeing the same error ” Authentication failure , Unknown content provider certificate issued by CA&amp;quot; on/while download of&nbsp;the jad file.</p>
    <p>Could any one found a solution for this.. </p>
    <p>We see one could download all the CA roots from <a href=”http://www.verisign.com/support/roots.html”>http://www.verisign.com/support/roots.html</a>. This gives all the root certs of VeriSign - Thawte Combined Roots. But which one of these cert needs to be installed on L.G phone and what are the steps for installation of these certs.</p>
    <p>Regards,<br />
    Nagendra<br />
    C.T.O<br />
    <a href=”http://www.tejasoft.com”>www.tejasoft.com</a></p>
    <p>&nbsp;</p>

  25. GirlinP Says:
    January 3rd, 2007 at 8:11 pm

    <p>Hi,</p>
    <p>&lt;span style=”FONT-SIZE: 8pt; FONT-FAMILY: Arial; mso-fareast-font-family: ‘Times New Roman’; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA”&gt;Does&nbsp;a J2ME&nbsp;application needs to be signed for it to successfully install and run on Nokia Series 60 phones?&nbsp; My unsigned application works fine on the emulators and I am thinking of not getting it signed&amp;hellip; unless&nbsp;singing is mandatory for it to work&nbsp;properly on Nokia series&nbsp;60 phones.&nbsp;&lt;/span&gt;</p>

  26. David Hayes Says:
    January 5th, 2007 at 12:07 am

    <p>Hi,</p>
    <p>The short answer is &amp;quot;It depends&amp;quot;. You only need to sign your application if it accesses any of the protected resources (e.g. network, addressbook, calender etc.). Some (most?) aggregators of content (Nokia, Orange, Vodafone etc. won’t touch your app unless it’s signed. It really depends what your app does, how you want to sell it and how annoying/frequent the security messages would be to your user.</p>
    <p>Hope this helps </p>
    <p>Dave</p>

  27. David Hayes Says:
    January 5th, 2007 at 12:16 am

    Hi,
    Sorry for the delay in replying (on holiday at the moment).
    I don’t know the Saynyo phone in question so I can’t help with that specifically but if you signed the jar/jad with your own certificate (i.e. not one boaught from Verisign/Thawte) you will need to install the certificate on the phone, I know for a fact you can’t do this on all phones though so this could be your problem.
    Try sending it via bluetooth/cable from your PC, often it will end up in your SMS inbox and you can install it from there but again this depends on your phone.
    Otherwise try copying it to a memory card and opening it from within the phones File Explorer (if it has one).
    If you have a certificate from Versign/Thawte/JavaVerified their root certificate SHOULD be on the phone but some phones are missing the some root certificates.
    Hope this helps.
    Dave

  28. Alvin Chang Says:
    January 18th, 2007 at 12:41 am

    Under “Authorization Failed”, you need to have a valid sim card in order to install. Those phones which can operate without a sim card will encounter this error.

  29. priyesh Says:
    January 21st, 2007 at 11:18 pm

    Hi David Hayes,
    I followed ur step…
    Generate a certificate and signed my jar and all the necessary steps.
    Now my problem is i want to attach that certificate with my application or i want to import that certificate in phone what’s the steps to do this? please reply…

    You can reply me on priyesh@usindia.com

    Thanks.

  30. vfrechette Says:
    February 9th, 2007 at 6:21 am

    Hi all,
    Once the JAR/JAD signing process is done, can I modify the JAD???
    Thanks.

  31. vfrechette Says:
    February 9th, 2007 at 8:59 am

    Hello ppl,

    My question is: After the signature process is done, can I modify the JAD file? <br /><br />
    Our process input the MIDlet-Jar-Size at the OTA.
    <br />
    Thanks

  32. David Hayes Says:
    March 24th, 2007 at 3:25 pm

    Hi,
    I believe you can modify the JAD file as long as you don’t modify any of the properties that need to match properties in the manifest. Caveat, I haven’t tried this so your best bet would be to test it…

  33. Ravi Says:
    April 4th, 2007 at 3:54 am

    hi , i followed all the steps but still getting the error on nokia 6681 - “Installation security error, unable to install”. The JAD/JAR signed with verisign trial certificate. plz help!!! thanks.

  34. Mauro Says:
    April 11th, 2007 at 12:57 pm

    Hi folks,

    I’m using Nokia E61. Question: Are there some way to when I install a midlet don’t be necessary to configure the ’suite settings’ to ‘always allowed’???

    []s

  35. Omry Yadan Says:
    July 1st, 2007 at 8:48 am

    as of Antenna 0.9.5, There is a new wtksign task that makes signing as easy as singing. :)

  36. Rakesh Says:
    July 6th, 2007 at 4:04 am

    Does anyone know what code signing certificate is “Yahoo Go” using ? ( Since it has a very large device supported list )

  37. rakesh Says:
    July 17th, 2007 at 7:24 am

    Hi Its a nice tutorial.
    i have signed my jad and jar and when i have transferred to a series 40 mobile i cannot install the application. it is saying invalid application.
    i am not able to install certificate also.
    for certificate it is saying file format not supported.

  38. dave Says:
    July 17th, 2007 at 11:09 am

    If you can’t install the appilcation I’d guess your jar is corrupt in some way, take a look at the manifest and check it looks ok. Also try and run it in an emulator (the Nokia ones are good). Try installing both using the jar and the jad, sometime if you can’t install from the jad the jar will be fine (pointing to a bad jad). I never found a way of installing a certificate on a series 40 phone. They seem to handle security in a very different way to the series 60 phones

  39. dude Says:
    July 19th, 2007 at 1:26 pm

    Hi,

    When i execute jad file appears a error message: impossible to verify digital signature. (in PDA)

    please help. thanks

  40. Javablog » How MIDlet Signing is Killing J2ME Says:
    August 9th, 2007 at 7:42 am

    [...] In the beginning of J2ME, it was decided that applications should be signed by a trusted authority or the user would be prompted to grant access to sensitive APIs. Practically, this meant that J2ME developers had to buy a signing certificate from somebody like Verisign or Thawte, costing about $500 for an unlimited number of signatures per year. Or you could upload your own self-made certificates to your handset for development purposes. David Hayes wrote an excellent tutorial on the subject. [...]

  41. Jhon Says:
    August 13th, 2007 at 8:35 am

    I have purchased the Verisign class 3 certificate and signed my jar and jad using this certificate.

    The application correctly installs on the SonyEriccson but failed to installed on Samsung D900. Do you know any thing about the root certificates installed on the samsung D900?

  42. Joe Says:
    August 13th, 2007 at 1:57 pm

    Nobody wants an annoying application that’s always asking for permission to do routine things. The current trusted computing model that Java is using doesn’t seem to give us any reliable way to solve this problem. Does it?

    We don’t have this trusted model in other computing environments and we get by just fine. Nobody needs to sign applications on Windows, OS X, Linux, etc. So is this progress, or just a step in the wrong direction?

  43. petu Says:
    September 4th, 2007 at 2:47 pm

    Hi,

    When browsing nokia n70 memory in mobimb I found certs file in path c:/System/Data/CACerts.dat.

    Could someone verify if this file is available in S60 3rd phones too. If so then it might be possible to install self signed certificate first to a S60 2nd phone and then hard copy the CACerts.dat file to the S60 3rd phone.

    btw. What are the costs to have a java midlet signed? I have made a small midlet for a small company and now the problem is I can’t install the midlet for their new phones (E50) because certificate won’t install to those S60 3rd phones.

  44. log.info “debugging my mind …” » Blog Archive » Installing Midlet ke HP Samsung (Ribet banget …) Says:
    September 27th, 2007 at 10:09 pm

    [...] Link : - http://www.spindriftpages.net/blog/dave/2006/06/18/midlet-jar-signing-a-tutorial-revised/ [...]

  45. Praca Damien Says:
    December 6th, 2007 at 7:49 am

    I am from a porting company, i spent a lot of time on the certification and there is one big problem in the signing procedure you are providing:
    ->In JavaME you do not need to sign the JAR (and you should not).

    JadTool.jar creates the digital signature of your JAR (SHA1 digest with the key of the certificate) and put it in the JAD.
    It is not required to sign the JAR, even if it’s possible : if you do so, it will create a digital signature of a signed jar - meaning a signature of signature.
    ->It will works on S60 (and you need to update the MIDlet-Size of the jad before signing it)
    ->BUT, it won’t work on any S40 (and Sony Ericsson built on S40), giving the error “Invalid application” at the end of the installation process.

    ->There’re also other advantages to not sign the JAR: it won’t add unnecessary extra data in your jar (5 to 10ko) and you do not need to update the the MIDlet-Size.

    jarsigner.exe is for the J2SE applications (when there is not file descriptor like the jad file).

    Regards
    Damien

  46. Praca Damien Says:
    December 6th, 2007 at 9:19 am

    The WTK Signing Tool (at least 2.5.1 and upper) just uses the JadTool.jar and the MEKeyTool.exe.
    If you pay attention, the WTK Sign MIDlet Utility only ask you for the JAD file and ONLY modifies the JAD file (the JAR isn’t modified, event a single byte).

    I would recommand also to always set all the required permissions in the JAD and to modify the JAD (e.g on the fly creation) only before signing it to avoid problems.
    Finally i would recommand to get at least a Verisign Class 3 and a Thawte Premium server CA certificate to cover a significant range of mobile and to script the signing process (batch or/and sh like i did - using a combination of keytool.exe from the JDK and JadTool.jar from the WTK to have a maximum of flexibility) to sign a huge list of JAD/JAR in one shot (which is not possible with the WTK utility).

    Hope it will help some of you,
    Regards

  47. boris Says:
    December 7th, 2007 at 6:04 am

    my SE k800i says “invalid certificate”. you what to do?

  48. boris Says:
    December 7th, 2007 at 6:06 am

    sry for my bad english.

  49. Damien Praca Says:
    December 7th, 2007 at 11:12 am

    About “invalid certificate” it can be everything and nothing…It depends on a lot of things since the messages displayed are not always clear.

    Without more information such as the way you signed it, the tools used, the type of certificate, the Certificate Authority, how you installed it, i cannot make a precise diagnostic.

    If it’s a self sign certificate i would check that the export of your certificate i correctly installed on the phone and its date of validity.
    If it’s a CA certificate, i would check first its validity, if the certificate reply has correctly been imported then check in the certificate list of the phone if it has the required CA roots.
    Finally the basic things, do not modify the jad after the signature, check it has all the required fields, that the jar is not signed.

    Regards,
    Damien - Mobile Distillery

  50. boris Says:
    December 8th, 2007 at 4:49 pm

    thanks for the fast answer :) :) :)

    i have made an own certificate like it was written in the tutorial.

    I’ve checked the date and it’s correct.

  51. Ryan Says:
    December 24th, 2007 at 5:07 am

    Can you please how to install a certificate…I have a 5300 Xpress Music phone and every time I import the cert file the phone indicates a invalid file format…Pls help!!!

  52. DrHu Says:
    January 6th, 2008 at 11:58 am

    It is painful to pay for the midlet to sign? Why should we pay it? It is my phone, if I want to install some application that I developed, why should I pay Verisign money!!! And also I hate the operators that disabled the J2ME API. Why? Because some API be disbaled onpurpose by the operator, like AT&T. Fox eample, nokia phone model 6085, when release in other country you can access getSnapshot() while in US you can’t. Why the AT&T or cingular disable the getSnapshot API. It is my phone and I as the owener of the mobile phone, should control the phone myself. Agree?

  53. Javablog » J2ME Development on OS X, revisited Says:
    January 17th, 2008 at 9:59 am

    [...] you to work out the details… setting up a certificate can be a real pain in the butt. Read David Hayes‘ excellent tutorial on getting the keys set [...]

  54. iomodo Says:
    January 29th, 2008 at 9:55 am

    I’ve made my own certificate using keytool. I try to install it via bluetooth, but my phone (SE w810i, K610i) says “invalid certificate”. What’s wrong with the certificate?
    please help

  55. Morlac Says:
    February 4th, 2008 at 9:28 am

    i found solution at least for SE w810i: the suffix of cert-file must be .cer (not .crt) - no more complaints about invalid certificate :)
    but till now i did not get my phone to install my app via jad file (i followed the howto step by step and the resulting jad looks like the above mentioned sample)

    anyone some ideas?

  56. TechTips4All » J2ME Midlet Jar Signing Says:
    February 8th, 2008 at 11:08 am

    [...] I recommend you to read this article: http://www.spindriftpages.net/blog/dave/2006/06/18/midlet-jar-signing-a-tutorial-revised/ [...]

  57. Carlo Deitmer Says:
    February 12th, 2008 at 4:15 am

    Sorry gentlemen, it is NOT possible to install your own Java MIDlet signing certificate on ANY mobile phone. Or has anyone found a way to assign a certificate to one of the phones security domains (Unidentified, Identified 3rd Pary, Operator, Manufacturer)? The phones come with pre-installed root certificates, each assigned to a security domain. Only the manufacturer can install the certificates. (Only exception: an operator/carrier can bring one on the SIM card.) If anyone else could install / modify a root certificate, it would break the whole Java ME security concept. Don’t believe me? Go to your phone manufacturer’s developer forum and ask them.
    For your better understanding of the Java ME security concept please read JSR 118, MIDP 2.1, chapters 3 and 4 (http://www.jcp.org/en/jsr/detail?id=118)

  58. chris Says:
    February 22nd, 2008 at 8:59 am

    Actually, this whole security model is stuffed anyway, and stiffles innovation and opensource.
    See:
    http://javablog.co.uk/2007/08/09/how-midlet-signing-is-killing-j2me/

    They should have left an exception to allow the OWNER of the phone to accept a 3rd party certificate (maybe with a disclaimer that if you do, the app could read/write your filesystem etc)

  59. navneet Says:
    March 18th, 2008 at 2:18 am

    hello i have sign certificate of Thawte and have sussecfully signed my application build. my problem is this signed build is working on nokia devies and sonyerrsion devices but when i instal my application on motorola or sumsung devices it give me application error .
    please reply me its urgent.

  60. DamionKutaeff Says:
    March 22nd, 2008 at 5:27 pm

    Hello everybody, my name is Damion, and I’m glad to join your conmunity,
    and wish to assit as far as possible.

  61. J2ME Development on OS X « Flowingcloud’s Weblog Says:
    April 15th, 2008 at 2:42 am

    [...] leave you to work out the details… setting up a certificate can be a real pain in the butt. Read David Hayes‘ excellent tutorial on getting the keys set [...]

  62. nightfrog Says:
    April 29th, 2008 at 5:31 am

    Hi,

    I’ve been able to sign files without probs for ages but when the jad is in a different place than the jar, the wtk utility is ‘unable to locate http://…../xxxx.jar‘ or $xxxx.jar$ so won’t sign it.

    Is there a way to avoid this problem if the jar needs to be on a different server?

    Thanks,

  63. D Legal Says:
    May 1st, 2008 at 12:12 pm

    I’m trying to build a secure phone application and I was wondering if you can help me? Do you have an updated tutorial to this one? The instructions seem pretty complicated and I was hoping there was an easier way of doing this.

  64. gabriel Azwat Says:
    May 7th, 2008 at 5:32 am

    i have bought my own certificate and signed my application when i send it to mobiles it look trusted but when i install it it give me an error Authorization failed i send it without Midlet Permission but it don’t send Sms may Anyone Help :(

  65. Xitara Says:
    May 8th, 2008 at 11:15 am

    Hello,
    how relevant is the 1.step where I should sign my .jar file with jarsigner?

  66. Chris Says:
    July 4th, 2008 at 12:14 pm

    Question: I have a Verisign cert for my midlet. What added value does WTK signature ( MIDlet-Jar-RSA-SHA1: ) give me?

    I have one in our JAD now, but if I change the JAR which I intend to do, I’d rather do without the extra signing step if Verisign is enough

  67. July Says:
    July 7th, 2008 at 2:21 am

    Hello Chris,
    as far as I understood the signing procedure,
    signing without MIDlet-Jar-RSA-SHA1 is dangerous.
    When am I allowed to compare, it’s like signing check without money amount in it.
    With the cert you identifies yourself and with this WTK signature you says what you sign.
    If someone changes your midlet code, WTK signature will be broken-> your signature isn’t valid anymore.

    And you’re right whenever you change your code, you have to sign again.

  68. PTViewerME2 Tutorial - Part 3 « This week in panospace Says:
    July 16th, 2008 at 11:03 pm

    [...] can be any name - we are not cryptographically signing the [...]

  69. Edward Says:
    August 2nd, 2008 at 8:18 am

    I wanna sign third-party .jar using this guide. But I can’t. It is said that I should sign .jad file. But I don’t have any. :(

  70. Olthyer Says:
    August 10th, 2008 at 9:55 am

    Hello!

    I have made the other big tutorial through (http://browndrf.blogspot.com/2006/06/build-and-install-singed-midlet.html), but always got the error: “Error verifying certificate provider” blah-blah. I was very sad and had no idea what to do. Then I begun to read your site, and in the common problems topic I’ve finally found: the date! After the restart the device’s date was in still 2006… Too early for my cert. :) Thank you very much! At last, my midlet is trusted! :)

    Anett

  71. Boris Dragovic Says:
    November 12th, 2008 at 6:58 am

    Hi All,

    I have certificates from both Thawte and Verisign - is there any way to sign midlet with BOTH in one go?

    Thanks,
    Boris

Comments