Sign MIDlet...The right steps

[matteopiccioni]

Hi all, i read a lot of messages about signing of midlets
Now i need to sign my midlet, so I try to explain what i have understand and Id like if u can help me where im wrong

Steps:
A) Create keystore
keytool -genkey -alias [SignedMidlet] -keyalg RSA -keystore midlet.sks
Here we have to add info about us: Name, Company, etc
[midlet.sks will be created]

B) Create certificate req:
keytool -certreq -alias [SignedMidlet] -keystore midlet.sks -file request.csr
Now we have to send request.csr for purchase a code-signing certificate from a CA (named for example CERT_FILE)

C) Certificate returned from CA can be imported:
keytool -import -file [CERT_FILE] -alias [SignedMidlet] -keystore midlet.sks

D)
Now with SUN Wireless toolkit we can do:
Run Utilities from start menu -> Sign Midlet -> Import Key Pair -> Select 'midlet.sks'

E)
Finally we can do:
Run Utilities from start menu -> Sign Midlet -> Sign MIDlet Suite -> Select out JAD

If I understand well, this will work...
In your opinion, is ok?



About CA:
We have to buy only Code-Signing certificate
Verisign or Thawte?
I need that application will:
Send SMS, Read into file system, Accept SMS-Push, Autostart, Camera control and gprs connection
And i need that after install the midlet no question will be for user and no special config will be done into user-phone

Verisign
http://www.verisign.com/products-ser...ing/index.html
Sun Java Signing Digital ID
Used with the Signing tools part of the Sun Java SDK, this certificate is used for generating digital signatures for Java Archive (JAR) files: Java applets, midlets and other Java applications that may be deployed stand-alone or in the IE or Netscape browsers.
1-Year$ $ 499


Thawte
https://www.thawte.com/process/retai...uctType=devel2
Certificato Sviluppatore JavaSoft
Questi certificati possono essere utilizzati con JavaSoft's JDK 1.3 e successivo per firmare applets.
Sorry but web page translate all in italian, anyway here no talk about midlets...only about applets
Is the same?
1-Year$ $ 199.00


My question is:
1) When you sign any midlet, you use Thawte or Verisign (the price is really different)?
2) What problems i will meet using Verisign or Thawte ?
3) All permission i need, will work using Verisign or Thawte?

Thanks for info and I hope this post will help other too

Matteo

[traud]

1) Thawte and VeriSign (because some models have only one of them)
2) A lot or none. Depends on your luck.
3) Nobody can tell this for sure, actually, I think many of your permissions will not be granted even in 3rd party domain, especially the SMS permissions. I recommend to play with the Platform SDKs which are quite correct and give you the maximum possible permissions in the 3rd party domain. However, operators may have changed the permissions to lower ones and/or require to use their certificate authority. Some devices have obscure permissions as well. Have a search on this forum, no one is able to answer this question in general.

[peterblazejewicz]

hi Matteo,

as traud mentioned in #3: signing midlet/app with cert does not mean that no user permission will be required because default settings for most apis are "session" not "blanket" as you presumed, so even if application is signed with 3rd party cert you need to explain user that she need to change suite security settings using application manager to not be asked at least once for permissions,
sms cannot be sent without user consent at all with 3rd party certs - we have such thread on forum somewhere about that specific api (WMAPI) topic,

regards,
Peter

[mikael_eko]

aku, ipul, hermanI already follow te right steps, but it cidn't help me.
I still get "Installation security error. Unable to Install".
This is my JAD :

MIDlet-1: Barablu,b_icon.png,main.Barablu
MIDlet-Jar-Size: 213810
MIDlet-Jar-URL: Barablu_208x208_Nokia_6230i_v.2.5_build_009.jar
MIDlet-Name: Barablu
MIDlet-Permissions-Opt: javax.microedition.io.Connector.socket, javax.microedition.io.Connector.file.write, javax.microedition.io.Connector.file.read
MIDlet-Vendor: Barablu
MIDlet-Version: 2.5
MicroEdition-Configuration: CLDC-1.1
MicroEdition-Profile: MIDP-2.0

MIDlet-Certificate-1-1: MIIEyTCCA7GgAwIBAgIQZyMWueaYoGetrwnT2novlzANBgkqhkiG9w0BAQUFADCBtDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNDEuMCwGA1UEAxMlVmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAwNCBDQTAeFw0wNzExMTkwMDAwMDBaFw0wOTExMTgyMzU5NTlaMIGMMQswCQYDVQQGEwJHQjEVMBMGA1UECBMMQ2FuYXJ5IFdoYXJmMQ8wDQYDVQQHEwZMb25kb24xEDAOBgNVBAoUB2JhcmFibHUxMTAvBgNVBAsTKERpZ2l0YWwgSUQgQ2xhc3MgMyAtIEphdmEgT2JqZWN0IFNpZ25pbmcxEDAOBgNVBAMUB2JhcmFibHUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKli7ts56rxLBu438MLxPIWFE+I5J9k7Gl+vlI+thF4LyXfGtvPwS2Id62fUM5Zn8Vi3T4ZzyKMtzIjux+x7CS7lAU23LS6FbHDx/W3GuKZm4p55Xmwj9m5Plr1HGCFfdNx52W/

MIDlet-Certificate-1-2: MIIEvzCCBCigAwIBAgIQQZGhWjl4389JZWY4HUx1wjANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQwNzE2MDAwMDAwWhcNMTQwNzE1MjM1OTU5WjCBtDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNDEuMCwGA1UEAxMlVmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAwNCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL687rx+74Pr4DdP+wMQOL4I0ox9nfqSfxkMwmvuQlKM3tMcSBMl6sFjevlRZe7Tqjv18JScK/vyZtQk2vf1n24ZOTa80KN2CB4iJyRsOJEn4oRJrhuKof0lgiwQMOhxqyjod0pR8ezN+PBU1G/A420Kj9nYZI1jsi1OJ/aFDv5t4ymZ4oVHfC2Gf+hXj61nwjMykRMg/

MIDlet-Certificate-1-3: MIICPDCCAaUCEHC65B0Q2Sk0tjjKewPMur8wDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2MDEyOTAwMDAwMFoXDTI4MDgwMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJXFme8huKARS0EN8EQNvjV69qRUCPhAwL0TPZ2RHP7gJYHyX3KqhEBarsAx94f56TuZoAqiN91qyFomNFx3InzPRMxnVx0jnvT0Lwdd8KkMaOIG+YD/isI19wKTakyYbnsZogy1Olhec9vn2a/

MIDlet-Jar-RSA-SHA1: Gm4pQJ/3LSltfbEG6AOamnhJgvbyCD7ExcHeA10QhhRs4ih+K3312+G5g+PsokAeeRlIvDGtITul/

I only signed the JAD.
I get the certificate from Verisign.

I really appreciate everything that can help me

Thank you very much

Mikael Eko

[traud]

Make sure you have set the date/time correctly on your phone, not deleted the VeriSign root certificate in the phone and then please post your full JAD within a code tag. I have not looked very much at yours, however, your MIDlet-Certificate are far too short to be true. I cannot make valid certificates out of them. Furthermore, I recommend to leave out MIDlet-Certificate-1-3 for a Nokia Series 40…

[asier.marzo]

Maybe I can help you:

I need to sign my midlet for allways allow connectivity, network access, read user data, write user data, etc...

But I was no sure if a Third Trusted Party Certificate allows my to do that.

So I download a file browser for the phone (in my case Y-Browser for s60 3rd), open
z:\system\data\midp2\security\policy\midp2_rp.xpf

you cann't modify the file but you can check what permission will you have with certain certificates.

[javadaemon]

I've found new service to sign midlet with a correct root certificate. http://j2start.com
What do you think? Does it work? It's cheap enough and they give one try for free.