Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My application is deployed as a self-signed applet to several thousand users at more than 50 schools across the country (in Norway). The user is presented with the standard Java security warning asking if they will accept the signature. When they do, the applet runs perfectly.

However, about half a year ago a group of 7 school, all under a common IT department, stopped getting the security warning. In stead the applet loads and starts running in untrusted mode, without first giving the user an option to accept or reject the signature.

The problem is on Windows machines, and only when the machine is connected to the schools network. If they take the same machine home with them, the program functions as it should, with security warnings and everything.

I know little about Window systems in general, but I would think it would be some sort of policy-file or something that is loaded when a machine hooks up to/through the schools network.

Furthermore, the problem only started occurring in these 7 schools after changes made after a security breach they had a while back. The IT department is stumped. I am stumped.

Any thoughts, comments, suggestions?

share|improve this question

migrated from stackoverflow.com Jan 27 '10 at 8:36

This question came from our site for professional and enthusiast programmers.

add comment

3 Answers

I'm no browser security expert, but I could imagine that the security settings for the browser have been changed to treat all non-trusted certificates (self signed certificates are not signed by a trusted certification authority (CA), so could come from anybody) as unsafe as a result of the security breach.

That would fit in with warnings not being issued and I can only imagine that this means the self-cert is automatically marked as untrusted, which is why the applet only runs in untrusted mode.

share|improve this answer
    
Yes, but why then does it work on the same computer at home but not at school? And I forgot to say that the problem occurs in all browsers on the same computer - both IE and FF. –  Terje Dahl Jan 26 '10 at 12:21
1  
Have a look at the java plugin control panel: JRE_PATH/bin/javacpl.exe and check the settings under Advanced > Security. Compare between the home and school computers. It may be that an option such as "Enable online certificate validation" is different and causes the behaviour. –  beny23 Jan 26 '10 at 15:25
add comment

Did your users try to clean the certificates on their machines ?

Control Panel / Java / Security / Certificate / Delete ?

As beny23 said, they may have considered by mistake the self-signed certificate as unsecure...

But it would not explain why the system can run from home...

share|improve this answer
    
Yes, checked the certificates-list. Also, Java stores a list of accepted certificates, but not a list of denied certificates. And as you say, it runs at home ... –  Terje Dahl Jan 26 '10 at 12:23
add comment

My best guess is that self-signed jars are being filtered our by a web proxy.

There is an "Allow users to grant permissions to content from an untrusted authority" option in the control panel. Also OCSP checking has changed default configuration between updates, although I guess that probably doesn't matter for self-signed.

I would strong suggest not accepting self-signed certificates.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.