title: Jarsigner: "This jar contains entries whose certificate chain is not validated."
body: <p>I get the following error on a self-signed jar:</p>
  
  <pre><code>jar verified.
  
  Warning:
  This jar contains entries whose certificate chain is not validated.
  
  Re-run with the -verbose and -certs options for more details.
  </code></pre>
  
  <p>I signed the jar like this:</p>
  
  <pre><code>"C:\Program Files\Java\jdk1.7.0\bin\jarsigner" -keystore myKeyStore myJar.jar myAlias
  </code></pre>
  
  <p>My jar has 2 entry points: One for java web start, and one for an applet.</p>
  
  <ul>
  <li>If I run the jar in a java web start way, it has no incidence.</li>
  <li>But if I run the jar as an applet. I get a strong security warning at some point when I try to access a bitmap resource embeded in the jar.</li>
  </ul>
  
  <p>Using the -verbose and -certs options shows a lot of lines. And I don't understand anything of this. This is the output: <a href="http://keyja.com/bin/output.txt" rel="noreferrer">output.txt</a>  (part of the 6307 lines reproduced below).</p>
  
  <pre><code>s     157850 Tue Nov 08 12:57:44 CET 2011 META-INF/MANIFEST.MF
  
        X.509, O=keyja.com
        [certificate is valid from 17/08/11 17:32 to 24/07/11 17:32]
        [CertPath not validated: null]
  
        112909 Tue Nov 08 12:57:44 CET 2011 META-INF/KEYJA_CO.SF
          1108 Tue Nov 08 12:57:44 CET 2011 META-INF/KEYJA_CO.RSA
  sm       180 Tue Nov 08 12:16:40 CET 2011 com/keyja/client/a/a/a/k.class
  
        X.509, O=keyja.com
        [certificate is valid from 17/08/11 17:32 to 24/07/11 17:32]
        [CertPath not validated: null]
  
  sm       252 Tue Nov 08 12:16:40 CET 2011 com/keyja/client/a/a/a/r.class
  ...
  (around 6000 lines of other output along the same lines)
  
    s = signature was verified 
    m = entry is listed in manifest
    k = at least one certificate was found in keystore
    i = at least one certificate was found in identity scope
  
  jar verified.
  
  Warning: 
  This jar contains entries whose certificate chain is not validated.
  </code></pre>
  
  <p>How to sign the jar file ? </p>