Firefox: Signature script shows scary certificate dialog

Question

Context: I write JavaScript to run the executable and configure some registry entries on the client machine. I signed .JAR using SignTool and my company’s Authenticode certificate, but when I run the script, a dialog box appears with the message:

There is no mention of a root certificate (in this case, Comodo, I believe), so I could also create a self-signed certificate to put the company name string in the dialog box.

My question is: is that all the user should see? This jar:http://www.mozilla.org/projects/security/components/signed-script-demo.jar!/signed-script-demo.html example page jar:http://www.mozilla.org/projects/security/components/signed-script-demo.jar!/signed-script-demo.html shows the same dialog, but there is still no either a “verify this certificate” link or a mention of the root CA.

Are there any new resources for writing signed scripts? The mozilla pages are mostly several years old, and there are many links to broken documentation on developer.netscape.com.

- Martin

Answer 1

The code that runs signed banks and raises privileges has also not changed in years, so the documentation must be correct. The code was not actually affected, because no one on the Internet uses this material. Yes, I know the chicken egg problem here with a crappy UI.

You can try to report a bug with Mozilla about this, but I'm not sure if this will work (but patches will probably be welcome).

Answer 2

We were forced to use signed scripts to access our Firefox add-on from JavaScript. I wrote my experience about this here .

Soon:

• encapsulate your preferred logic on a separate HTML + JS page
• make this page relevant for working with page loading
• sign it and put it on the server (you need packaging, custom content type, etc.).
• on regular (unsigned) pages: load a signed page into a hidden IFRAME and interact with it using JavaScript callbacks