views:

754

answers:

1

What exactly do certificates purchased from a CA do again (in the context of Java applets)?

Lets say I have an applet on a website that accesses the users files (requiring a security certificate). If I make a self-signed certificate, the client will get a security warning asking if the client should trust this application. If I purchase a certificate from a CA, does that security warning not appear and automatically grant access? If it doesn't remove the security warning, is there a point to buying one, other than to reassure the client?

Does this work with all CAs, or just VeriSign and Thawte?

EDIT: I found this extremely helpful tutorial on how to set up a free verified certificate from Thawte: http://www.dallaway.com/acad/webstart/

+2  A: 

Under Sun's implementation, a dialog asking whether security should be removed will be shown for all certificates (except the JavaFX certificate). For a self-signed certificate, the dialog should have a warning colour and note that the certificate cannot be verified. For a verified certificate from any known CA will cause a blue dialog to be shown. A tickbox is provided always accept the certificate. The Java Control Panel set configuration options not to allow users to trust certificates (probably a very good idea).

Tom Hawtin - tackline
So the difference is that a verified certificate from a known CA has a safer looking warning box.So do JavaFX applications have warning boxes at all? Do they need certificates for "dangerous" actions? Or are you saying that verified certificates make JavaFX applications run automatically without warning?
Trusted JavaFX code needs a certificate in exactly the same way as Java code or code produced with any other compiler does. However, the code that forms the JavaFX runtime library is signed with a specially trusted certificate, so that when you run untrusted JavaFX with the trusted JavaFX library no dialog is shown.
Tom Hawtin - tackline
I tried the JavaFX samples at http://javafx.com/samples/ and many of them had the security notification pop up. Is this only because they are not verified certificates? If they were verified, would they then automatically run without any notification?
Many of the sample have application code (i.e. non-library code) that is signed with normal certificates.
Tom Hawtin - tackline