N95 - Signed app gives 'Unable to Install'

[ariejan]

Hello,

I've developed a simple app that allows easy uploading of photo's to our website. The app is tested and works well when installed on a N95 - unsigned. Of course, there are a lot of security warnings about accessing the file system and network.

Recently we purchased a code sign certificate from Thawte to sign our app. Done this I'm no long able to install the app on any N95!

When I upload the app, the N95 finds the app is trusted/verified, so the certificate is working. However, when I install the app the progress bar stops at about 80% and then gives "Unable to install". I've tried this on at least four different N95 devices, two of which have the lastest firmware installed for sure. I even did a hard-reset on one N95, but that also didn't help.

A common culprit is the files size in the JAD file. I double-checked this and the number of bytes are correct.

Does this problem sound familiar to anyone, and how can it be resolved? Below you find the contents of the JAD file, if that helps. (Not that I shortened the certificate hashses for viewing purposes here.

MIDlet-1: Uploader,/org/netbeans/microedition/resources/file.png,nl.kabisa.mgl.uploader.UploaderMIDlet
MIDlet-Certificate-1-1: MIIDQTCCAqqgAwIBAgIQak
MIDlet-Certificate-1-2: MIIDTjCCAregAwIBAgIBCjAN
MIDlet-Certificate-1-3: MIIDJzCCApCgAwIBAgIBATA
MIDlet-Jar-RSA-SHA1: mNcZ9EEk71F71jPMVp0m2
MIDlet-Jar-Size: 148176
MIDlet-Jar-URL: Uploader.jar
MIDlet-Name: Uploader
MIDlet-Permissions: javax.microedition.io.Connector.http, javax.microedition.io.Connector.file.read, javax.microedition.securityservice.CMSMessageSignatureService, javax.microedition.io.Connector.ssl, javax.microedition.io.Connector.socket, javax.microedition.io.Connector.cbs, javax.microedition.io.Connector.datagram, javax.microedition.io.Connector.datagramreceiver, javax.microedition.io.Connector.file.write, javax.microedition.io.Connector.https, javax.microedition.io.Connector.serversocket, javax.microedition.content.ContentHandler, javax.microedition.io.Connector.comm
MIDlet-Vendor: Corp. Name.
MIDlet-Version: 1.0.0
MicroEdition-Configuration: CLDC-1.1
MicroEdition-Profile: MIDP-2.0

[laker]

Try removing MIDlet-Permissions: both from JAD and Manifest.

[prajapati.ajay]

hi frnd

have you checked application installation permission is set to allow or not.
also check your device date sometimes if date is passed year then it creates problem while installation of application

thanks

[ariejan]

Try removing MIDlet-Permissions: both from JAD and Manifest.

I removed all API Permissions in NetBeans -> Project Properites -> Application Descriptor -> API Permissions. After this, the MIDlet-Permissions lines are no longer in the JAD and Manifest. Still, I get the same "Unable to install" error.

[ariejan]

hi frnd

have you checked application installation permission is set to allow or not.
also check your device date sometimes if date is passed year then it creates problem while installation of application

thanks

Device is set to allow all apps (not only signed apps). The unsigned app installs fine, the signed one does not.

Also, the date is correct. I'm not working on RDA (Remote Device Access) and the date and time are set correctly there too. So this can't be teh problem either.

Any other suggestions? I'd be pulling my hair out right now if I had any.

[traud]

Please, go through a list of common issues.

Any other suggestions?

Nokia offers paid technical support for everyone …

[ariejan]

Please, go through a list of common issues.Nokia offers paid technical support for everyone …

Is it me or are you linking to 'common issues' for Sony Ericsson? The problem only occurs on Nokia devices.

I've tried this on multiple N95 devices (this is the only device this app has to run on). I've also tried a N71 (failed) and a HTC Diamond, where the app installed and worked flawlessly.

My guess is that this is a problem with Nokia only, but I'm not sure of it yet.

[traud]

Is it me […]

Yes.
Again, I recommend to go through that list. At least one you violated already. If another MIDlet works (last crosscheck point), however, yours still not work, then you should go for paid support as you might found a bug.

I shortened the certificate hashses for viewing purposes here.

Not a good idea as it prevents checking your path of certificates. VeriSign issued some broken ones, recently. Furthermore, shortening does not matter in a code tag.

MIDlet-Certificate-1-3: MIIDJzCCApCgAwIBAgIBATA

Not aware of a single phone requiring this. Makes trouble for some devices. Remove.

MIDlet-Jar-URL: Uploader.jar

Some devices require absolute URLs. However, as you say this is just for Nokia, it should not matter here.

MIDlet-Permissions: […]

Are you really sure, your MIDlet requires all those permissions?

[ariejan]

Yes.
Again, I recommend to go through that list. If you still not able, then you should go for paid support as you might found a bug.

Yes, I went through the list already. Everything on it has been mentioned on these forums (albeit in different places).

Kind of funny that I should get paid support when I find a bug. If I did find a bug, I'm doing Nokia's QA work. Nokia should pay me

Another option is to write off the old N95's and purchase mobiles from another vendor that do work. We had success with HTC.

[traud]

Kind of funny […]

I do not make the rules.
If you gone through that list (why not using it in your JAD?) and read the whole discussion board, you need another support channel like paid technical support.

[mattbrenner]

Hi,

I was going crazy trying to get my signed MIDlet to run on an N95 as 'Trusted Third Party.' I use NetBeans and bought a Thawte certificate. It would install without problem, even when I set the phone to allow only signed apps--but was always untrusted. I was sure I was doing everything right, and I had no problems on a handful of S40 devices (2760, 3610, 6085). I wasted a lot of time trying to get to the bottom of that one. Eventually, I tested on more S60 devices (E62, E72, E75, 5800) and I had no problems on any of them. The N95 is an oddball in some regards.

I even wrote directly to Traud (he never responded).

I must say that pointing out that "Nokia offers paid technical support for everyone..." is both obvious and unhelpful, especially when someone is asking a serious-minded question, and has obviously spent considerable time finding, reading, and experimenting with the available information. It would more helpful and courteous to write, "I'm sorry, I don't know what's wrong, and I don't have the time or inclination to look into your problem."

[traud]

I even wrote directly to Traud (he never responded).

Do I have to respond? Anyway, I replied via the discussion board …

I must say that pointing out that "Nokia offers paid technical support for everyone..." is both obvious and unhelpful, especially when someone is asking a serious-minded question, and has obviously spent considerable time finding, reading, and experimenting with the available information. It would more helpful and courteous to write, "I'm sorry, I don't know what's wrong, and I don't have the time or inclination to look into your problem."

That is your opinion. I do understand your frustration, however, I do not follow you.

Many developers do not consider Nokia’s paid services. Some developers cannot afford them, however, some are simply not aware of it. Especially, if

• someone does not follow the recommendations posted
  that is okay, however a reason why would be good
• does not like to post the public certificates
  that is okay as it would show who you are, however, providing the JAD/JAR then is not possible either
• does not answer to questions asked

it is time ask someone trustable – which is Nokia or your certificate supplier. Furthermore, I do not own all devices or firmware variants. If the problem might be related to something like that and my list did not help, then I think it is the easiest and fastest way to go for paid support rather than wasting further (of your) time with community-based support.

It would more helpful and courteous to write, "I'm sorry, I don't know what's wrong, and I don't have the time or inclination to look into your problem."

The community-based way is not to post any answer. Otherwise, I could create millions of posts like this all day long. Some cases require the JAD/JAR. Personally, testing those is over my top but does not prevent other members to do so. Again, I recommend anyone to check Opera Mini: It includes a VeriSign or Thawte certificate just as you like.

[ariejan]

I'm aware of Nokia's paid services. But your motivation for obtaining paid support ("you may have found a bug") is not valid. If I found a bug, Nokia should not fix it at my expense.

Anyway, can we keep the discussion focussed on the problem of getting my app running on the N95. I'm currently running through the provided list again. Hope it helps.

[ariejan]

Hey everyone,

I've just checked everything in the list mentioned before for a third time.

Here's what my JAD looks like now. Also, the date and time are set correctly. With this JAD, after removing the MIDlet-Certificate-1-3 line, as suggested for Thawte, I get a "Certificate Error".

Now, I'm not sure if this is due to the missing line in the JAD or the fact that there is actually something wrong with my certificate? I don't get this error with the Certificate-1-3 line included.

MIDlet-1: Uploader,/org/netbeans/microedition/resources/file.png,nl.kabisa.mgl.uploader.UploaderMIDlet
MIDlet-Certificate-1-1: MIIDQTCCAqqgAwIBAgIQakBQvk3EXeKE8GPTMl9tOTANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEfMB0GA1UEAxMWVGhhd3RlIENvZGUgU2lnbmluZyBDQTAeFw0wOTEwMjAwMDAwMDBaFw0xMDEwMjAyMzU5NTlaMHYxCzAJBgNVBAYTAk5MMRYwFAYDVQQIEw1Ob29yZCBCcmFiYW50MQ4wDAYDVQQHEwVCdWRlbDEUMBIGA1UEChMLS2FiaXNhIEIuVi4xEzARBgNVBAsTCkthYmlzYSBJQ1QxFDASBgNVBAMTC0thYmlzYSBCLlYuMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOHZtTdQHBgsn3rPnQakClJg3kFLjbwgy32LNMw2luyAVcUJTnc2Abh7m4WY3GF1ZwJ+3adOH3NN/o6OSoiDF1B3iW7eeW/dPMdKq9b4hKglOvIvBCFyZysNYPDdJKCh7tfhziwHDAR+ihQmlNwAb6bx4Hkj3kfCKvxBBRqPdQ2QIDAQABo4HwMIHtMAwGA1UdEwEB/wQCMAAwPgYDVR0fBDcwNTAzoDGgL4YtaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZUNvZGVTaWduaW5nQ0EuY3JsMB8GA1UdJQQYMBYGCCsGAQUFBwMDBgorBgEEAYI3AgEWMB0GA1UdBAQWMBQwDjAMBgorBgEEAYI3AgEWAwIHgDAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnRoYXd0ZS5jb20wEQYJYIZIAYb4QgEBBAQDAgQQMBYGA1UdEQQPMA2CC0thYmlzYSBCLlYuMA0GCSqGSIb3DQEBBQUAA4GBACn0voEkouAmbG4SMc3Fzrrl1nK8MhYns/2tm9lw4NFcQQK43VihD720aNpwJI2IowtgNVIGms61nkHUOEfqr209k4fLiPHV8evtKFyaZtF+uqPauvFa06M67cp8tlqH3iKhY3pPQDOerrd/QYkUupZ3YNOEZqgRlSuk+lJ5NzNW
MIDlet-Certificate-1-2: MIIDTjCCAregAwIBAgIBCjANBgkqhkiG9w0BAQUFADCBzjELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYDVQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFByZW1pdW0gU2VydmVyIENBMSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNlcnZlckB0aGF3dGUuY29tMB4XDTAzMDgwNjAwMDAwMFoXDTEzMDgwNTIzNTk1OVowVTELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xHzAdBgNVBAMTFlRoYXd0ZSBDb2RlIFNpZ25pbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMa4uSdgrwvjkWll236N7ZHmqvG+1e3+bdQsf9Fwd/smmVe03T8wuNwh6miNgZL8LkuRNYQg8tpKurT85tqI8iDFIZIJR5WgCRymeb6xTB388YpuVNJpofFMkzpB/n3UZHtjRfdgYB0xHaTp0w+L+24mJLOo/+XlkNS0wtxQYK5ZAgMBAAGjgbMwgbAwEgYDVR0TAQH/BAgwBgEB/wIBADBABgNVHR8EOTA3MDWgM6Axhi9odHRwOi8vY3JsLnRoYXd0ZS5jb20vVGhhd3RlUHJlbWl1bVNlcnZlckNBLmNybDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwMwDgYDVR0PAQH/BAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwyLTE0NDANBgkqhkiG9w0BAQUFAAOBgQB2spzuE58b9i00kpRFczTcjmsuXPxMfYnrw2jx15kPLh0XyLUWi77NigUG8hlJOgNbBckgjm1S4XaBoMNliiJn5BxTUzdGv7zXL+t7ntAURWxAIQjiXXV2ZjAe9N+Cii+986IMvx3bnxSimnI3TbB3SOhKPwnOVRks7+YHJOGv7A==
MIDlet-Jar-RSA-SHA1: mNcZ9EEk71F71jPMVp0m2e9ML2fQ0WEx36TOxXJqtK5cKe8eSlGRjn+KoqheyH97v+qcn71Uw1RnUrS0Gch6sz+oycDJ46g3M8jZkuxePOmmpUs98aZaLF4zI4Ph3nq+HPQieM/BCm01T1YKHqvFJB16u3d7ANkNIDaz5vSOpa0=
MIDlet-Jar-Size: 148176
MIDlet-Jar-URL: Uploader.jar
MIDlet-Name: Uploader
MIDlet-Vendor: Kabisa ICT
MIDlet-Version: 1.0.0
MicroEdition-Configuration: CLDC-1.1
MicroEdition-Profile: MIDP-2.0

[traud]

Your certificate path builds correctly up to the root. MIDlet-Certificate-x-3 is not required for Thawte, at least here with my Nokia S60 3rd Edition Feature Pack 1 device. You can check yourself: Download the Thawte signed variant Opera Mini with your computer, remove that line and beam it over to your Nokia.

Make sure Thawte root is present: Nokia N95 » Menu » Tools » Settings » General » Security » Certificate management » Authority certificates » MIDP2 Thawte Premium Server CA » Options » Trust settings » App. installation » Yes.