My goal is to get a Java Deployment Rule Set in place in my organization, but I do not want to pay third-party certificate authority for a code signing cert when we have a working CA running through Active Directory. I have followed what I think is the correct procedure to get this accomplished, however when I finally go to run any Java applet I receive the following error:
Can not verify self-signed Deployment Rule Set jar
The steps I followed are:
- Exported our root CA certificate
- Imported root certificate into cacerts in JRE install path
- Imported root certificate into a personal keystore
- Generated a CSR with keytool for a new cert with personal keystore
- Submitted CSR to enterprise CA using certreq, with the "Code Signing" template
- Imported that cert into the personal keystore
- Created a very basic deployment rule set and compiled it into a jar
- Signed the jar with the cert in the personal keystore from step 6
- Copied the signed jar into \Windows\Sun\Java\Deployment\
The above steps all completed without error - nothing about invalid certificate chains or the like. I can see the root CA cert in the Java control panel and when I click on the Deployment Rule Set link in the control panel and view its cert, I see the cert from step 6 and it's parent CA, both of which have future expiration dates and correct information as far as I can tell. But I still receive the verification error when running any applet
So - is it simply not possible to do this, and we have to pay for a cert? Or am I (hopefully) doing something incorrectly? If anyone has any insight it would be greatly appreciated, thanks!