title: Get rid of the "UNKNOWN" publisher from applet security warning
body: <p>I'm trying to <strong>sign an applet</strong> so that the <strong>publisher</strong> does not appear as "<strong>UNKNOWN</strong>" :</p>
  
  <p><img src="https://i.stack.imgur.com/3xCnj.png" alt="Applet security warning showing an &quot;UNKNOWN&quot; publisher"></p>
  
  <p>I work for an organisation and we have <strong>our own certification authority</strong>, <strong>certificate chain</strong> is the following : <em>ORG Root CA > ORG Trusted Certification Authority > Yann39 (me :D)</em></p>
  
  <p>I requested a certificate and they provided me a link to get it into the browser.
  Then I exported it (from Firefox) to get the PKCS#12 file that I named <strong>mystore.p12</strong>.</p>
  
  <p>Then I did the following to <strong>sign my applet</strong> :</p>
  
  <pre><code>/* TO KNOW THE ALIAS */
  c:\testrep&gt;keytool -list -storetype pkcs12 -keystore mystore.p12
  Enter keystore password:  ********
  
  Keystore type: pkcs12
  Keystore provider: SunJSSE
  
  Your keystore contains 1 entry
  
  id de yann39, Oct 24, 2012, keyEntry,
  Certificate fingerprint (MD5): D7:E3:83:1D:C1:40:68:72:5F:A8:6F:AC:3A:EA:DD:47
  
  /* CREATE FAKE CLASS FILE AND BUILD A JAR */
  c:\testrep&gt;echo test &gt; test.class
  c:\testrep&gt;C:\oracle\dev10gr2\jdk\bin\jar cf0 test_applet.jar test.class
  
  /* SIGN THE JAR */
  c:\testrep&gt;C:\oracle\dev10gr2\jdk\bin\jarsigner -verbose -storetype pkcs12 -keystore mystore.p12 test_applet.jar "id de yann39"
  Enter Passphrase for keystore: ********
   updating: META-INF/MANIFEST.MF
     adding: META-INF/ID_DE_YA.SF
     adding: META-INF/ID_DE_YA.RSA
    signing: test.class
  
  /* VERIFY THE SIGNATURE */
  c:\testrep&gt;C:\oracle\dev10gr2\jdk\bin\jarsigner -verify -verbose -certs test_applet.jar
  
           132 Wed Oct 24 17:49:52 CEST 2012 META-INF/MANIFEST.MF
           185 Wed Oct 24 17:49:52 CEST 2012 META-INF/ID_DE_YA.SF
          4801 Wed Oct 24 17:49:52 CEST 2012 META-INF/ID_DE_YA.RSA
             0 Wed Oct 24 17:48:36 CEST 2012 META-INF/
  sm         0 Wed Oct 24 17:47:46 CEST 2012 test.class
  
        X.509, CN=Yann39, CN=794324, CN=myname, OU=Users, OU=Organic Units,
  DC=myorg, DC=ch
        X.509, CN=ORG Trusted Certification Authority, DC=myorg, DC=ch
        X.509, CN=ORG Root CA, DC=myorg, DC=ch
  
  
    s = signature was verified
    m = entry is listed in manifest
    k = at least one certificate was found in keystore
    i = at least one certificate was found in identity scope
  
  jar verified.
  
  c:\testrep&gt;
  </code></pre>
  
  <p>Then I <strong>load the appled</strong> in my application using the following :</p>
  
  <pre><code>&lt;object id="mytestapplet" width="0" height="0" style="position:absolute" type="application/x-java-applet"&gt;
  &lt;param name="archive" value="https://myhost.ch/rep/test_applet.jar"&gt;
  &lt;param name="code" value="test"&gt;
  &lt;param name="scriptable" value="true"&gt;
  &lt;param name="mayscript" value="no"&gt;
  &lt;/object&gt;
  </code></pre>
  
  <p>I read some posts like this one : <a href="https://stackoverflow.com/questions/5642837/how-to-sign-java-applet-with-pfx-file">How to sign java applet with .pfx file?</a> and it seems <strong>I should get</strong> <code>smi</code> when verifying signed file from the jar, not only <code>sm</code> that means the certificate was not found in the keystore.</p>
  
  <p>So <strong>I thought the certificate chain was not complete</strong>, but when running the following command, <strong>I saw that it was not the case</strong> :</p>
  
  <pre><code>c:\testrep&gt;keytool -list -v -storetype pkcs12 -keystore mystore.p12
  Enter keystore password:  ********
  
  Keystore type: pkcs12
  Keystore provider: SunJSSE
  
  Your keystore contains 1 entry
  
  Alias name: id  de yann39
  Creation date: Oct 24, 2012
  Entry type: keyEntry
  Certificate chain length: 3
  Certificate[1]:
  Owner: CN=Yann39, CN=794324, CN=myname, OU=Users, OU=Organic Units,
      DC=myorg, DC=ch
  Issuer: CN=ORG Trusted Certification Authority, DC=myorg, DC=ch
  Serial number: 12d21eb200200000a02b
  Valid from: Mon Jun 25 14:16:00 CEST 2011 until: Wed Jun 24 14:16:00 CEST 2013
  Certificate fingerprints:
           MD5:  D7:E3:83:1D:C1:41:78:72:5F:A8:6D:BD:3A:ED:DD:48
           SHA1: 24:31:1D:25:02:98:0D:F8:28:6A:F1:0E:E8:BB:04:7E:51:E2:E9:66
  Certificate[2]:
  Owner: CN=ORG Trusted Certification Authority, DC=myorg, DC=ch
  Issuer: CN=ORG Root CA, DC=myorg, DC=ch
  Serial number: 601fab4c000000000003
  Valid from: Tue Oct 02 11:36:53 CEST 2006 until: Mon Oct 02 11:47:53 CEST 2016
  Certificate fingerprints:
           MD5:  51:A1:EA:33:21:2C:71:60:A1:6F:F1:22:92:A8:51:8D
           SHA1: 66:CD:70:13:27:68:F3:C2:08:F3:BE:5F:BF:D4:17:BD:85:9D:10:65
  Certificate[3]:
  Owner: CN=ORG Root CA, DC=myorg, DC=ch
  Issuer: CN=ORG Root CA, DC=myorg, DC=ch
  Serial number: 7dc0d089138d1d804b2e68e21b947412
  Valid from: Tue Oct 02 10:55:19 CEST 2006 until: Sat Oct 02 11:01:47 CEST 2026
  Certificate fingerprints:
           MD5:  A2:CE:DC:7D:F5:60:D7:2C:5E:B5:29:74:9D:51:F9:49
           SHA1: DA:D8:7F:63:95:90:A2:E4:D4:1D:B9:48:FD:F4:C3:5C:FC:2B:B6:A3
  
  
  *******************************************
  *******************************************
  
  
  
  c:\testrep&gt;
  </code></pre>
  
  <p>The chain seems good.</p>
  
  <p>But I <strong>still</strong> get the <strong>security warning</strong> with an <strong>"UNKNOWN" Publisher</strong>. <strong>Why</strong> ?</p>
  
  <hr>
  
  <h2>EDIT 25-OCT-2012</h2>
  
  <p>I forgot to say that <strong>it works using Internet Explorer</strong> ("Signature has been verified" and Publisher is "Yann39"), not using Chrome or Firefox.</p>
  
  <p>I tried using a <strong>self-signed</strong> certificate :</p>
  
  <pre><code>keytool -genkey -alias myalias -storetype PKCS12 -keystore mykeystore.p12 -dname "cn=Yann39, ou=UN, o=ORG, st=Geneva, c=CH"
  keytool -list -v -storetype pkcs12 -keystore mykeystore.p12
  echo test &gt; test.class
  C:\oracle\dev10gr2\jdk\bin\jar cf0 myapplet.jar test.class
  C:\oracle\dev10gr2\jdk\bin\jarsigner -verbose -storetype pkcs12 -keystore mykeystore.p12 myapplet.jar "myalias"
  C:\oracle\dev10gr2\jdk\bin\jarsigner -verify -verbose -certs myapplet.jar
  </code></pre>
  
  <p>It does not work neither in IE nor in Firefox or Chrome, normal.</p>
  
  <p>I tried to add the 2 trusted certificates from my organisation but <strong>it failed</strong> :</p>
  
  <pre><code>keytool -import -alias "myalias_root" -file ORGRooTCA.crt -storetype pkcs12 -keystore mykeystore.p12
  keytool -import -alias "myalias_auth" -file ORGTrustedCertificationAuthority.crt -storetype pkcs12 -keystore mykeystore.p12
  </code></pre>
  
  <p>with the error :</p>
  
  <pre><code>keytool error: java.security.KeyStoreException: TrustedCertEntry not supported
  </code></pre>
  
  <p>I still don't understand why it says that the certificate was not found in the keystore (<code>sm</code>) when verifying the signature.</p>
  
  <hr>
  
  <h2>EDIT 02-NOV-2012</h2>
  
  <p>I finally got a reply from my Certification Authority. As code signing certificates are provided for test only (not officially supported in our organisation), they don't provide any help and they closed my ticket...</p>
  
  <p>The 2 certificates <strong>ORG Root CA</strong> and <strong>ORG Trusted Certification Authority</strong> are trusted in the 3 browsers (IE, Firefox, Chrome). When running my applet I still get the expected result in IE :</p>
  
  <ul>
  <li><strong>Name</strong>: applettest</li>
  <li><strong>Publisher</strong>: Yann39</li>
  <li><strong>From</strong>: <a href="https://myhost.ch" rel="nofollow noreferrer">https://myhost.ch</a></li>
  </ul>
  
  <p>But not in Firefox and Chrome :</p>
  
  <ul>
  <li><strong>Name</strong>: test</li>
  <li><strong>Publisher</strong>: UNKNOWN</li>
  <li><strong>From</strong>: <a href="https://myhost.ch" rel="nofollow noreferrer">https://myhost.ch</a></li>
  </ul>
  
  <p>Another strange thing is that as you see IE is referencing as “Name” the id of the <code>&lt;object&gt;</code> tag used in the HTML (<em>applettest</em>), while Firefox and Chrome are referencing the name of the main class (<em>test</em>).</p>
  
  <p>What I think is that it is the same thing about the <strong>Publisher</strong>, IE is looking at the <code>CN</code> RDN (<em>Yann39</em>) while Firefox and Chrome are looking at the <code>O</code> RDN and cannot find one as it is not defined in my certificate.</p>
  
  <p>If anyone has more information about how browsers check the certificates please share.</p>
  
  <p>Thanks.</p>