Download the JDK
Search the Tutorials
Hide the TOC
Trail: Security Features in Java SE
Lesson: Signing Code and Granting It Permissions
Section: Steps for the Code Receiver
Signing Code and Granting It Permissions
Steps for the Code Signer
Download and Try the Sample Application
Create a JAR File Containing the Class File
Generate Keys
Sign the JAR File
Export the Public Key Certificate
Steps for the Code Receiver
Observe the Restricted Application
Import the Certificate as a Trusted Certificate
Set Up a Policy File to Grant the Required Permission
Start Policy Tool
Specify the Keystore
Add a Policy Entry with a SignedBy Alias
Save the Policy File
See the Policy File Effects
Home Page > Security Features in Java SE > Signing Code and Granting It Permissions
Import the Certificate as a Trusted Certificate

> Before you can grant the signed code permission to read a specified file, you need to import Susan's certificate as a trusted certificate in your keystore.

> Suppose that you have received from Susan

> - the signed JAR file `sCount.jar`, which contains the `Count.class` file, and

> - the file `SusanJones.cer`, which contains the public key certificate for the public key corresponding to the private key used to sign the JAR file.

> Even though you created these files and they haven't actually been transported anywhere, you can simulate being someone other than the creater and sender, Susan. Pretend that you are now Ray. Acting as Ray, you will create a keystore named `raystore` and will use it to import the certificate into an entry with an alias of `susan`.

> A keystore is created whenever you use a `keytool` command specifying a keystore that doesn't yet exist. Thus we can create the `raystore` and import the certificate via a single `keytool` command. Do the following in your command window.

> 1. Go to the directory containing the public key certificate file `SusanJones.cer`. (You should actually already be there, since this lesson assumes that you stay in a single directory throughout.)

> 2. Type the following command on one line:

>    >     keytool -import -alias susan
>    >        -file SusanJones.cer -keystore raystore

> Since the keystore doesn't yet exist, it will be created, and you will be prompted for a keystore password; type whatever password you want.

> The `keytool` command will print out the certificate information and ask you to verify it, for example, by comparing the displayed certificate fingerprints with those obtained from another (trusted) source of information. (Each fingerprint is a relatively short number that uniquely and reliably identifies the certificate.) For example, in the real world you might call up Susan and ask her what the fingerprints should be. She can get the fingerprints of the `SusanJones.cer` file she created by executing the command

> >     keytool -printcert -file SusanJones.cer

> If the fingerprints she sees are the same as the ones reported to you by `keytool`, the certificate has not been modified in transit. In that case you let `keytool` proceed with placing a trusted certificate entry in the keystore. The entry contains the public key certificate data from the file `SusanJones.cer` and is assigned the alias `susan`.

Previous page: Observe the Restricted Application
Next page: Set Up a Policy File to Grant the Required Permission