S60 Signing and Certification

[Nokia Ron]

Question: Is application signing mandatory in S60 3rd Edition?

Answer: Yes, application signing is mandatory. Note that applications can be developer-signed, because Symbian Signed is not mandatory in S60 3rd Edition. An application can be signed with a developer-created certificate, which is created with the MakeKeys utility included in the S60 3rd Edition SDKs. If an application needs to gain access to certain Symbian OS platform security capabilities that are not user-grantable or certain market channels, it must instead be Symbian Signed.

More about Platform Security, Symbian Signed and certification can be found from the brand new Platform Security section in Forum Nokia. Just browse it at
Forum Nokia -> Platforms -> S60 Platform -> Platform Security.

http://www.forum.nokia.com/main/plat.../security.html

[antonypr]

Question: I got one the following messages when installing signed application in S60 3rd Edition phones:
- "Certificate error. Contact the application supplier"
- "Unable to install. Constrained by the certificate"
- "Required application access not granted"
- "Unable to install a protected application from an untrusted supplier"
- "Unable to install"

Answer: I have posted a blog explaining several error messages that may pop up when installing signed application in S60 3rd Edition phone. Take a look at it at http://blogs.forum.nokia.com/view_entry.html?id=93. Hope this helps solving your problem.

Antony

[pharoah90]

Hi..
I have certificate error problem which my fren dont have.. and i have certificate error with all the sis file i tried to installed.. I am using 3250.. and i cant go to the url you provided.. it got bug..

[wizard_hu_]

Remove the closing parenthesis from the end of the URL.
If you have error, and others do not, the first thing you should check is the date and time of the phone (devices do not accept time-traveller installer files from the future), and the second one is to enable installation of all/untrusted appliactions in the settings page of the Application Manager.

[truf]

Hi,
I have a pkg file which intall 4 applications. I realise communication between them via a settings file. That file installed in c:\system\data\. I add an empty file to pkg to guarantee it's uninstallation, bcs FN option depricated in 3rd ed. Instead that its recommended to use private folders and thats is a note from SDK:

A package can only deliver a data file into the private directory belonging to any executable in the package. If therefore, a package delivers 3 executables: SID1, SID2, SID3 (where SID stands for Secure ID), then data files can be delivered to /private/SID1/, /private/SID2/, or /private/SID3/. In an upgrade, this is also possible by associating the upgrade package with the SIDs present in the original package unless one of the original executables is to be removed during the upgrade.

But I cant implement interprocess communication using private folders. And I cant implement it in any other way instead of settings file.
So, thats my question - is this situation couse any problems while signing?

[wizard_hu_]

Have you seen http://discussion.forum.nokia.com/fo...d.php?t=112915?

[petrib]

Question: Is application signing mandatory in S60 3rd Edition?

Answer: Yes, application signing is mandatory.

No, application signing is not mandatory; S60 3rd Ed. allows also unsigned apps (that only call unrestricted APIs or those requiring capabilities the phone user can grant).

[wizard_hu_]

No, application signing is not mandatory; S60 3rd Ed. allows also unsigned apps (that only call unrestricted APIs or those requiring capabilities the phone user can grant).

Can you install a non-signsis-ed application to any 3rd edition device? I have some doubts: even the prototypes from a year before refused to install anything that was not signed (and that signing restricted you from nothing, I used All -TCB all the time. But the signing itself was mandatory).

[petrib]

Yes (unless an operator has restricted the phone to only signed apps). The setting to allow unsigned apps (All) or only signed apps is in the Application Manager (Options > Settings).

In other words, application signing is not mandatory on current S60 3rd Edition devices (or Symbian 9 in general).

[antonypr]

@petrib: Do you mean "unsigned application" == "application signed with self-signed certificate"?

This is the copy of S60 SDK 3rd Edition documentation (copied from Introduction to S60 3rd Edition | Testing and Signing With Symbian Platform Security | Symbian Security Model):

"S60 3rd Edition introduces mandatory signing of applications. This means that the application will not install if it has not been signed."

[khurshed79]

Yes (unless an operator has restricted the phone to only signed apps). The setting to allow unsigned apps (All) or only signed apps is in the Application Manager (Options > Settings).

In other words, application signing is not mandatory on current S60 3rd Edition devices (or Symbian 9 in general).

Hi,

I confirm that applcation without signing does not work on S60 3rd edition devices. In Application Manager, (Options->Settings), I changed the Software installation to -> All. Then I tried to install an unsigned app, it didn't work. So signing is mandatory in S60 3rd edition devices

[antonypr]

Yes, I think it is mandatory in S60 3rd Edition -> at least from all the devices that I have ever used.

There is even worse situation in some countries because the operators allow installation of signed application from Symbian Signed only. Even application signed with self-signed certificate will not work.

Read also my blog post, http://mobile.antonypranata.com/2006...ymbian-signed/.

Antony

[antonypr]

No, application signing is not mandatory; S60 3rd Ed. allows also unsigned apps (that only call unrestricted APIs or those requiring capabilities the phone user can grant).

Petrib, at least in the current implementation of S60 3rd Edition, signing is mandatory. If we install unsigned application (even with no capability at all), S60 will display "Certificate error. Contact the application supplier".

I am not sure about the future S60 releases.

Antony

[petrib]

I mean "unsigned application" == "application not signed at all with any certificate whatsoever".

Symbian 9 requires apps to be signed only if they call Symbian APIs protected by capabilities that the user can't grant (the app UID must also be from the unsigned range, or it doesn't install).

[ptrmn]

petrib: S60 3rd ed. requires SIS files to be signed. Sure, it may not be mandatory in Symbian, but it is in S60.