Certificate install doesn't have option "Application Installation" on N80

[rl0pes]

Hi, i have already spend two days reading and trying things to get my certificate working but there is no way.

I create a certificate following the following steps:

openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -outform DER -out ca.cer


But when i try to install it on my N80 seems ok but i only have two options:

- Internet
- Verify online

There is no "Application Installation" option, however if i look at other certificates installed (Verisign, etc..) they have that option, what am i doing wrong?

[hartti]

You are not doing anything wrong. You cannot install your own certificates on the devices allowing application signing on S60 3rd edition devices.

Hartti

[rl0pes]

Is this something new on S60 3º Ed ?

Am i forced to buy a certificate from a trusted CA ?

Do i have any choice to get a free certificate for my application ? at least for testing?

Thanks.

[petrib]

https://www.symbiansigned.com/app/page/devcertgeneral

[rl0pes]

I try that, i will comeback soon.
Thanks.

[rl0pes]

I got my Symbian Developer Certificate .cer file. The certificate is valid (at least windows says so) but none of the tools i have to sign applications in java seems to like it.

When i try to import the certificate to a keystore i get this message:

keytool error: java.lang.Exception: Input not an X.509 certificate

When i try to import the certificate on Nokia Carbide it throws a CertificateParsingException telling "invalid DER-encoded certificate data".

How do i use this certificate to sign the jar, none of the tools seems to like, i'm starting to think that is only usefull for C++ apps, on the page there is no reference to Java...

What do i do ????

Thanks.

[traud]

Well, Symbian is not Java. Not sure, why petrib has linked to this. Have a look at this answer which points all (three) alternative authorities you have, however, as hartti pointed out, self-siging has been removed in the 3rd Edition of Nokia S60.

Anyway, about the importing bug – if you are curious (will not work at the end either):
Drop it on a text editor and if you can read in the first line Begin certificate, you have a PEM (Base64) encoded certificate. Just convert it to DER with tools like OpenSSL…

[hartti]

I just reread the MIDP security domain document during the weekend. There is this sentence in the document (Page 10, under 3rd party protection domains)

"Any Authority Certificates obtained after device manufacture MUST NOT be used for authentication of MIDlet suites."

Hartti

[browndrf]

I don't know much about other handsets but I was able to install a self-signed CA on my 6682 phone.
I was also able to sign and install a test MIDlet with a cert issued by my CA cert

take a look at http://browndrf.blogspot.com/

[rl0pes]

Thanks hartti,

Somebody should think creating a CA for opensource and testing porpuses (i didn't found any) or a "I don't care my phone explode" option in the security definitions of the mobile :-)

browndrf, i was trying to do exactly that, but it seems that the new security model of Symbian 9 doesn't allow this (your mobile is Symbian 8), thanks anyway.

traud, i only have those 3 choices? is not possible for someone that have a certificate from a trusted CA to create a new CA an sell certificates, something like:

I trust A, A certifies B, B certifies C, C sign application ??

Is there any good webpage that explain how certificates work?

Thanks.

[hartti]

browndrf - yes, that is possible on the device you mentioned. But not on S60 3rd edition devices.

Hartti

[traud]

"Any Authority Certificates obtained after device manufacture MUST NOT be used for authentication of MIDlet suites."

I know. However, as we both discussed this is a MUST NOT which can be fixed with a bug. Additionally, the whole document is just a recommendation. It is not followed word-by-word. For example the default permissions vary even within Nokia land. As far as I know there is no JSR (like JTWI 175 and MSA 248) which makes this informative document and/or this statement normative.

I only have those 3 choices?

Yes, and many phones do not have all three, so for most compatibility you have to go for at least two out of the three. You can buy these certificates once and use them for all your applications – within the validity of the cert of course. Additionally, Forum Nokia is full of turtorials and informative resources on this topic.

[rl0pes]

Thank you all,

Just one final question, imagine that the validity of the certificate is one year (i believe this must be the case for most of then) what happends when that period expires: ?

- The application installed on the mobile stops working ?

- Is not possible to install the application (signed before the validity ended) if the install date if after the validity period ?

- Is not possible to sign any more applications?

Thanks.

[traud]

Should, Should, Does not matter.

All of this can be found in the Nokia tutorial on signed MIDlets above. However, as there are bugs all around there is no guarantee, this is the same for all other manufactures.