Is this code signing certificate valid for signing applets?

Question

We bought a code signing certificate for signing applets, but when signing an applet we get the following error.

C:\CM\WEB-INF>jarsigner -keystore code_signing.keystore C:\CM\SweetApplet.jar code_signing_real Enter Passphrase for keystore: jarsigner: Certificate chain not found for: code_signing_real. code_signing_real must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain. 

Is our certificate confirmed? Here is the certificate below. The error message seems to suggest that the certificate must contain the private key, but we do not understand how this can be, since the private key should never be exposed to anyone but us.

 C:\CM\WEB-INF>keytool -list -keystore code_signing.keystore -alias code_signing_real -v Enter keystore password: Alias name: code_signing_real Creation date: Mar 13, 2014 Entry type: trustedCertEntry Owner: CN=CE, OU=CE, O=CE, L=PAL O ALTO, ST=California, C=US Issuer: CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US Serial number: 728b78e4ded46af26494c59690e428f0 Valid from: Wed Mar 12 17:00:00 PDT 2014 until: Fri Mar 11 15:59:59 PST 2016 Certificate fingerprints: MD5: E0:DB:9E:DC:37:1E:C2:A9:EA:C0:A8:21:22:61:9F:DD SHA1: F9:C3:75:37:CA:86:4D:E2:11:BE:52:79:CE:FA:B3:6B:32:F0:CF:D2 Signature algorithm name: SHA1withRSA Version: 3 Extensions: #1: ObjectId: 2.5.29.19 Criticality=true BasicConstraints:[ CA:false PathLen: undefined ] #2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false AuthorityInfoAccess [ [accessMethod: 1.3.6.1.5.5.7.48.1 accessLocation: URIName: http://ocsp.thawte.com] ] #3: ObjectId: 2.5.29.4 Criticality=false #4: ObjectId: 2.5.29.31 Criticality=false CRLDistributionPoints [ [DistributionPoint: [URIName: http://cs-g2-crl.thawte.com/ThawteCSG2.crl] ]] #5: ObjectId: 2.5.29.37 Criticality=false ExtendedKeyUsages [ codeSigning 1.3.6.1.4.1.311.2.1.22 ] #6: ObjectId: 2.16.840.1.113730.1.1 Criticality=false NetscapeCertType [ Object Signing ] 

Answer 1

He does not say that the certificate should contain a private key. Certificates do not contain private keys. Read it again. He says the key entry must contain the private key and certificate.

So, however you built this KeyStore, it is not valid. You may have just imported a signed certificate into a new KeyStore or with a new alias. You must import it into the original KeyStore, where the private key is located, with the same alias as the private key.

You must also import the certificate chain as a trusted CA certificate with a different alias.