Download the JDK
Search the Tutorials
Hide the TOC
Signing Code and Granting It Permissions
Steps for the Code Signer
Download and Try the Sample Application
Create a JAR File Containing the Class File
Generate Keys
Sign the JAR File
Export the Public Key Certificate
Steps for the Code Receiver
Observe the Restricted Application
Import the Certificate as a Trusted Certificate
Set Up a Policy File to Grant the Required Permission
Start Policy Tool
Specify the Keystore
Add a Policy Entry with a SignedBy Alias
Save the Policy File
See the Policy File Effects
Trail: Security Features in Java SE
Lesson: Signing Code and Granting It Permissions

> This lesson shows how to use use `keytool`, `jarsigner`, `Policy Tool` and `jar` to place files into JAR (Java ARchive) files for subsequent signing by the `jarsigner` tool.

> This lesson has two parts. First, you will create and deploy an application. Second; you will act as the recipient of a signed application.

> Here are the steps to create and deploy an application:

> Note: For convenience, you pretend to be a user/developer named Susan Jones. You need to define Susan Jones when you generate the keys.

> - Put Java class files comprising your application into a JAR file
> - Sign the JAR file
> - Export the public key certificate corresponding to the private key used to sign the JAR file

> Here are the steps to grant permissions to an application

> Note: For convenience, you pretend to be a user named Ray.

> - You see how the signed application cannot normally read a file when it is run under a security manager.
> - Use `keytool` to import a certificate into Ray's keystore in an entry aliased by `susan`
> - Use the Policy Tool to create an entry in Ray's policy file to permit code signed by `susan` to read the specified file.
> - Finally, you see how the application running under a security manager can now read the file, since it has been granted permission to do so.

> For more information about digital signatures, certificates, keystores, and the tools, see the API and Tools Use for Secure Code and File Exchanges lesson.

> > Important: You need to perform the tasks in this lesson while working in the directory in which you store the sample application, but you should store the data file needed by the application in a different directory. All examples in this trail assume that you are working in the `C:\Test` directory, and that the data file is in the `C:\TestData` directory.
> > If you are working on a UNIX system, substitute your own directory names.

> Here are the steps:

> - Steps for the Code Signer

> - Steps for the Code Receiver

Previous page: Previous Lesson
Next page: Steps for the Code Signer