你如何签署Java Midlet？

时间：2009-09-05 16:55:48

标签： java midlet sign

答案相当复杂的简单问题：

如何签署Java Midlet，以便将其加载到安全提示较少的手机上？

2 个答案:

答案 0 :(得分：25)

获取所需软件

        
  1. 来自Java SDK (JDK)的Sun（您应该已经拥有此内容）
    2.     
  2. Java Wireless Toolkit (WTK)也来自Sun
    3.     
  3. （可选）获取并安装Ant和Antenna以允许您自动构建（我强烈推荐这些）

    4. 导入现有证书（如果有）

          
    1. 如果您已从Verisign（或其他提供商）购买证书，则需要将证书导入J2SE密钥库。
      2.     
    2. 尝试使用以下命令keytool -import -alias {myalias} -file {mycertificate}（由于我没有合适的证书，我无法对此进行测试）
      3.     
    3. 运行keytool -list以查看新证书
      4.     
    4. 接下来，您必须导出证书才能将其导入手机
      5.     
    5. 运行keytool -export -alias {myalias} -file mycertificate.crt
      6.     
    6. 将证书导入手机（详见下文）

      7. 创建并导入新的（测试）证书

            
      1. 您需要使用keytool（来自JDK）
        2.     
      2. 我使用了以下命令keytool -genkey -alias {myalias} -keyalg RSA -validity 365
        3.     
      3. 这将提示您输入密钥库密码，输入您的密钥库密码（如果您有现有的密钥库）或者如果您还没有密码库密码则输入
        4.     
      4. 填写有关位置/公司名称等的所有提示。
        5.     
      5. 运行keytool -list以查看新证书
        6.     
      6. 接下来，您必须导出证书才能将其导入手机
        7.     
      7. 运行keytool -export -alias {myalias} -file mycertificate.crt
        8.     
      8. 将证书导入手机（详见下文）
        9. C:\j2sdk1.4.2_08\bin>keytool -genkey -alias company -keyalg RSA -validity 365
Enter keystore password: password
What is your first and last name? [Unknown]: My Name
What is the name of your organizational unit? [Unknown]: company
What is the name of your organization? [Unknown]: company
What is the name of your City or Locality? [Unknown]: location
What is the name of your State or Province? [Unknown]: location2
What is the two-letter country code for this unit? [Unknown]: GB
Is CN=My Name, OU=company, O=company, L=location, ST=location2, C=GB correct? [no]: yes
Enter key password for (RETURN if same as keystore password):

        构建并打包应用程序

              
        1. 使用javac构建MIDlet，特别注意classpath和bootclasspath选项（否则预验证将失败）。我还将目标设置为1.1并将源设置为1.3
          2.     
        2. 生成JAD文件JAD中的关键属性  MIDlet-Jar-URL，MIDlet-Jar-Size，MIDlet-Permissions我们还包括MIDlet-Icon，MicroEdition-Configuration，MicroEdition-Profile，MIDlet-Name，MIDlet-Push-1，MIDlet-Icon，MIDlet-Description和MIDlet-版本
          3.     
        3. 根据您的JAD生成MANIFEST.MF文件，您必须删除MIDlet-Jar-Size和MIDlet-Jar-URL
        4. Both these tasks can be completed using the wtkJad Antenna task
        5. Package and preverify the app using the wtkPackage Antenna Task you must set the classpath and bootclasspath properties correctly otherwise Preverification will fail
          6.

        Sign the application

        1. Sign the Application using jarsigner
        2. Run jarsigner -keystore {mykeystore} -storepass (mypassword} {myjar} {myalias}
        3. Now you have a signed jar you need to update the MIDlet-Jar-Size in your JAD
        4. Now add the certificate to the JAD using JadTool.jar from the WTK
        5. Run java -jar JadTool.jar -addcert -alias {myalias} -storepass {mypassword} -keystore {mykeystore} -inputjad {myinputjad} -outputjad {myoutputjad}
        6. Now add the signature to the JAD again using JadTool.jar
        7. Run java -jar JadTool.jar -addjarsig -alias {myalias} -jarfile {myjar} -storepass {mypassword} -keypass {mypassword} -keystore {mykeystore} -inputjad {myinputjad} -outputjad {myoutputjad}

        Deployment

        1. Deploy this to a web server with the MIME types set correctly and download it to your phone and it will be a trusted 3rd party application
        2. You can also deploy applications to phones by sending the JAR & JAD to the phone over Bluetooth or Infrared or a cable depending on your phones features. On Nokia phones the files appear in your SMS Inbox

        Installing the Certificate on the phone

        1. Import the certificate into your phone, in Windows XP SP2 I could do this by right clicking the file and selecting "Send to Bluetooth Device", you should be able to send files by cable or Infra Red (IR) too. NB: I haven't found anyway of importing a certificate on a Series 40 phone
        2. Once the certificate is installed it needs to be authorised for "Application Installation". On my phone (Nokia 6680) this is under Tools->Settings->Certificate Management->Trust Settings, I turned on everything but I think "Application Installation" is all you need

        Common Problems

        1. Application not installed using the JAD: The application is only trusted if it is installed using the JAD, the application will still install from the jar but it won't be trusted.
        2. Application trust settings not set: Once your application is installed you need to specify how much trust to give it (it doesn't get all permissions by default). On a Nokia Series 60 phone these are found under the App. Manager.
        3. Root certificate missing from phone: The Java Verified certificate and/or Verisign certificates are missing from some phones check under Tools->Settings->Certificate Management for the relevant certificate
        4. Authorization Failed: - There are a whole host of possible reasons behind this here are the ones I've come across
          1. Certificate missing from phone, double check your certificate is installed and has been marked as trusted for application installs in Certificate Management
          2. Reboot: Uninstall the application completely then reboot your phone try taking the battery and SIM out too, often things get themselves in a twist, especially if you've been re-installing a lot without uninstalling first
          3. JAD/JAR mismatch: Double check the application size in the JAD, remember it's the number of bytes that is important NOT the size on disk
          4. Browser cache: If you're installing over the air make sure you clear your browser cache before installing
          5. I've heard but not verified that line breaks in the MIDlet-Permissions can cause problems but it seems ok to me on Nokia 6680/6630/6230i (could be firmware dependent?)
          6. The MIDlet-Permissions attribute is the cause of a lot of problems (especially since the documentation is often wrong/missing or different depending on the phone), try leaving it out first and add permissions in one at a time. Some phones will complain about permissions they don't support, some will ignore them
        5. There is a bug in some early Nokia 6600 firmwares that stop the install of trusted MIDlets
        6. Certificate not valid yet: If you generated the certificate yourself it may have a start validity date of tomorrow, also if your PC and phone dates are different you may be outside the period of validity of the certificate
        7. No certificate management on Series 40 phones, you can install a signed application but behavior is strange with self signed certificates
        8. JadTool problems: I haven't experienced any of these issues but lots of other people have
          1. "I have issues if I try to use the jadtool manually. I have a certificate chain and can't seem to get the second certificate added to the JAD file using any WTK jadtool. The interesting part however is that I can successfully sign the midlet using any of the same WTK GUI interfaces - they add the second certificate correctly. My steps:
            1. Use 1.4.2_06 jarsigner.exe to sign jar
            2. Use WTK (2.2 or 2.3 beta) jadtool to addcert with certnum 1
            3. If I call jadtool to addcert with certnum 2 the same certificate is inserted as cert 1-2 I'm assuming I am doing something incorrectly since the WTK gui seems to be working just fine"
          2. "I received a post on the KVM news group on the topic that states there is a bug in the jadtool and the author claims to have filed a bug report and posted a patch: http://archives.java.sun.com/cgi-bin/wa?A2=ind0508&L=kvm-interest&F=&S=&P=9858 One interesting note that was also posted was that the cert JAD params are static so once you get them from the WTK correctly you can put them statically in the ant script."
          3. "I am trying to sign a MIdlet for Nokia 6620 device. I am using a Verisign Code Signing certificate that actually contains two certificates (User and Intermediate CA). I am using the WTK 2.2 signing tool. Do you know if this tool support two certificates when signing ? The signature is added to the JAD file with two certificates but I have been getting security error when installing. I have checked on the device and there are different root certificates installed for Verisign but it still fails !
          4. "If you want, you can download the sprintpcs developer kit as it supports dual certs (http://developer.sprintpcs.com). However, I never got that cert to work on the Nokia (6620/cingular) phone, although it does work on sprint phones (with developer root enabled). Ultimately, I only got things to work by creating the cert as described in this blog and installing that on the phone. Bizarrely, even though the root cert for my versign-signed cert *was* on the 6620 phone, it still would never install my MIDlet as you would think it should."
        9. Old phones (6230/i, 6682) don't support x509 certificates, WPKI has been suggested as a possible solution but I haven't investigated this
        10. Socket connections can be problematic (http://discussion.forum.nokia.com/forum/showthread.php?t=68306 ) possibly due to the WAP infrastructure and the services provided by an operator. HTTP is a much safer protocol to use
        11. "Go online and check application validity": Yes/No. If I click on yes button the phone I get the following error: "Certificate revoked for this application" and the installation fails. To rectify this go to Tools -> Manager -> Menu -> Settings -> Online Certif Check [ On / Off / Required] There is also a Default address setting. If the online control setting is required, the check will fail, if there is no default address. see http://discussion.forum.nokia.com/forum/showthread.php?t=71071

        Trust Domains

        1. There are 4 different trust domains in MIDP2 (manufacturer, operator, trusted third party, and untrusted). Trusted Third Party is the only one of any use to us really.It gives the following options on my Nokia 6680 (Vodafone UK):
          2. Network Access: Not Allowed, Ask every time, Ask first time Messaging: Not Allowed, Ask every time App Auto-Start: Not Allowed, Ask every time, Ask first time Connectivity: Not Allowed, Ask every time, Ask first time, Always allowed Multimedia: Not Allowed, Ask every time, Ask first time Read User Data: Not Allowed, Ask every time, Ask first time, Always allowed Edit User Data: Not Allowed, Ask every time, Ask first time, Always allowed
        2. These settings are defined by the operator and the phone manufacturer and therefore vary between phone, manufacturer and operator.

        Unresolved Problems

        1. I managed to sign the JAD with this format using J2ME WTK utilities, but when trying to install it on the device I get a message "Application authentication failed 909".

        Sample JAD

        MIDlet-Jar-URL: MyApp.jar
MIDlet-Jar-Size: 201365
MIDlet-Name: MyApp
MIDlet-Vendor: EC1M
MicroEdition-Profile: MIDP-2.0
MicroEdition-Configuration: CLDC-1.1
MIDlet-Icon: logo.png
MIDlet-Push-1: sms://:6553,net.ec1m.MyApp.midp.MyAppMIDlet,*
MIDlet-Description: MyApp MIDlet
MIDlet-Permissions: javax.microedition.io.PushRegistry,javax.microedition.io.Connector.sms...
MIDlet-Version: 1.0.67 MIDlet-1: MyApp, logo.png,net.ec1m.MyApp.midp.MyAppMIDlet
MIDlet-Certificate-1-1: MIICODCCAaECBEKqpfswDQYJKoZIhvcNAQEEBQAwYz...=
MIDlet-Jar-RSA-SHA1: EUsAch/.../hEZOsJsiCjBOhNs/3FSw4=

        Sample Manifest

         {{2} }

        示例Ant构建文件 我已将EC1M ant build file放在我们的网站上（希望）让这一切变得更加容易。 其他资源 这个FAQ on the Nokia Forum值得一读。

答案 1 :(得分：2)

步骤1：     创建可能由

引发的CSR请求 
1) Creating keystore and using that generate CSR file.
2) Perform steps given by certificate authority and download CSR and private key files.

步骤2：     将您的信息提供给证书颁发机构进行验证。

第三步：     您将获得代码签名证书。

步骤4：     您需要下载中间证书以及根证书。

步骤5：     现在你将拥有your_domain_name.crt，IntCertCA.crt，TrustedRoot.crt 

Now you need to create a chained certificate by combining all above certificates.

1) Open a text editor (such as wordpad) and paste the entire body of each certificate into one text file in the following order:

    The Primary Certificate - your_domain_name.crt
    The Intermediate Certificate - IntCertCA.crt
    The Root Certificate - TrustedRoot.crt
    Make sure to include the beginning and end tags on each certificate. The result should look like this:

    -----BEGIN CERTIFICATE----- 
    (Your Primary SSL certificate: your_domain_name.crt) 
    -----END CERTIFICATE----- 
    -----BEGIN CERTIFICATE----- 
    (Your Intermediate certificate: IntCertCA.crt) 
    -----END CERTIFICATE----- 
    -----BEGIN CERTIFICATE----- 
    (Your Root certificate: TrustedRoot.crt) 
    -----END CERTIFICATE-----

    Save the combined file as your_domain_name.pem. The .pem file is now ready to use.

步骤6：         将私钥导入your_domain_name.pem 

    openssl pkcs12 -export -in your_domain_name.pem -inkey your_private_key.key -out output_file_name.p12 -name your_alias


    NOTE: PLEASE REMOVE \ FROM FOLLOWING COMMANDS AND EXECUTE ( \ IS BASICALLY COMMAND CONTINUETY )

步骤7：         从output_file_name.p12

创建密钥库 
    keytool -importkeystore \
     -deststorepass changeit -destkeypass changeit -destkeystore your_domain_keystore.ks \
     -srckeystore output_file_name.p12 -srcstoretype PKCS12 -srcstorepass your_store_password \
     -alias your_alias

步骤8：         注意：请在开始跟踪命令之前备份您的JAD文件。

    Add your certificates to your your_midlet_name.jad file.

    java -jar JadTool.jar -addcert -alias your_alias \
    -storepass your_store_password \
    -keystore your_domain_keystore.ks \
    -inputjad your_midlet_name.jad -outputjad your_midlet_name.jad

第九步：         注意：请在开始跟踪命令之前备份您的JAD文件。

    Sign your midlet, also use your_midlet_name.jad file generated from Step8.

    java -jar JadTool.jar -addjarsig \
    -alias your_store_password \
    -storepass your_store_password \
    -keypass your_store_password \
    -keystore your_domain_keystore.ks \
    -inputjad your_midlet_name.jad -outputjad your_midlet_name.jad
相关问题
最新问题