Jarsigner: "This bank contains records whose certificate chain has not been verified."

Question

I get the following error on a self-signed bank:

jar verified. Warning: This jar contains entries whose certificate chain is not validated. Re-run with the -verbose and -certs options for more details. 

I signed the bank as follows:

 "C:\Program Files\Java\jdk1.7.0\bin\jarsigner" -keystore myKeyStore myJar.jar myAlias 

My bank has two entry points: one for the Java web start and one for the applet.

• If I run jar in java web start, it has no frequency.
• But if I run the jar as an applet. At some point, I get a strong security warning when I try to access the bitmap resource built into the bank.

Using the -verbose and -certs options shows a lot of lines. And I don’t understand anything about this. This is the result: output.txt (part of the 6307 lines below).

 s 157850 Tue Nov 08 12:57:44 CET 2011 META-INF/MANIFEST.MF X.509, O=keyja.com [certificate is valid from 17/08/11 17:32 to 24/07/11 17:32] [CertPath not validated: null] 112909 Tue Nov 08 12:57:44 CET 2011 META-INF/KEYJA_CO.SF 1108 Tue Nov 08 12:57:44 CET 2011 META-INF/KEYJA_CO.RSA sm 180 Tue Nov 08 12:16:40 CET 2011 com/keyja/client/a/a/a/k.class X.509, O=keyja.com [certificate is valid from 17/08/11 17:32 to 24/07/11 17:32] [CertPath not validated: null] sm 252 Tue Nov 08 12:16:40 CET 2011 com/keyja/client/a/a/a/r.class ... (around 6000 lines of other output along the same lines) s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore i = at least one certificate was found in identity scope jar verified. Warning: This jar contains entries whose certificate chain is not validated. 

How to sign a jar file?

Answer 1

Thanks to Andrew Thompson. I have unsigned my jar file and found an error. This is better unsigned, you are right in this because signing does not make sense, since I do not need to get out of the sandbox.

For the record, the error was in using the jnlp.jar library. To make it work, I launched the applet using the jnlp / applet code instead of the standard tag.

Answer 2

Only one line answers the question I am suggesting. And if you look closer, you will see it. Here

---

[certificate is valid from 17/08/11 17:32 to 24/07/11 17:32]

How can I hope you know that today is not July 24th, so you just need to rewrite your application

Answer 3

I have exactly the same problem.

In newer versions of Java 7 and Java 6, a change in validation has occurred. Error ID: 6861062 java classes_security Disable MD2 in certificate chain validation.

When signing the Jara file, I got a warning message and when I ran the command: jarsigner MyTools.jar -verify -verbose -certs

I got a message: X.509, OU = Class 3 Public Primary Certification Authority, O = "VeriSign, Inc.", C = USA [certificate is valid from 01/29/96 01:00 to 08/02/28 01:59] [CertPath not verified: algorithm constraint verification failed: MD2withRSA ]

My solution: - use a different version of the JDK for signing and JRE Plugin. - Update your certificate security to not use this algorithm.

Hope this helps you.

Hi