title: Signing a jnlp in order to get rid of the Security Warning
body: <p>I am developing at a company where a jnlp file is used to start a swing web based java application. It has plenty of jars that are downloaded to the client's jvm cache. When I updated my jvm to its currently latest version (build 1.7.0_45-b18) I started seeing the security warning below when I try to run the jnlp file:</p>
  <p><img src="https://i.stack.imgur.com/8qYxd.png" alt="Unknown publisher error" /></p>
  <p>After I saw this error and read this article about signing jnlp files from oracle site( <a href="https://blogs.oracle.com/thejavatutorials/entry/signing_a_jnlp_file" rel="nofollow noreferrer">Signing JNLP files</a>)
  then I added three things to the project:</p>
  <ol>
  <li>A <strong>JNLP-INF</strong> folder including an <strong>APPLICATION.JNLP</strong> file into all my jars except third party ones.</li>
  <li>Signing all those jars with the digital certificate+keystore bundle of my own company</li>
  <li>Importing the digital certificate into my trusted Ca certificates of jvm via java control panel.</li>
  </ol>
  <p>After I did the changes above and tried to run the jnlp file after deployment of new jars I got the following Security warning message from jvm:</p>
  <p><img src="https://i.stack.imgur.com/Z8pgs.png" alt="known publisher but still jnlp not signed error" /></p>
  <p>As you can see the Security Warning's severity level is changed to a more welcoming level and now the publisher's name is not unknown.It is the name from the certificate. Even if the warning's level is decreased it is still a warning and I dont want my end users to see this everytime. How can I solve this problem?</p>
  <ol>
  <li>Should I try to sign all third part jars as well? If so how can I do it with an Ant command? How can I extract a third party jar and add the JNLP-INF folder in it and then repack it as a jar by using Ant?</li>
  <li>Should I also sign the final <em>myapplication</em>.ear file with a JNLP-INF subfolder in it.This ear file is deployed to jboss server?</li>
  <li>Should I add some extra lines to my META-INF/MANIFEST  files in jars?</li>
  <li>Should I be expecting oracle to block my application to run on jvm with this level of warning?</li>
  </ol>
  <p>My JNLP file is this text:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;
      &lt;jnlp spec=&quot;1.0+&quot; codebase=&quot;http://10.100.10.9/ikarusdelhitest/&quot; href=&quot;ikarus.jnlp&quot;&gt;
  &lt;information&gt;
      &lt;title&gt;Ikarus&lt;/title&gt;
      &lt;vendor&gt;My Company name&lt;/vendor&gt;
      &lt;homepage href=&quot;http://www.mycompanyname.com&quot; /&gt;
      &lt;description&gt;My jnlp triggered web based enterprise software&lt;/description&gt;
      &lt;icon href=&quot;ikarus.ico&quot; /&gt;
      &lt;offline-allowed /&gt;
  &lt;/information&gt;
  &lt;security&gt;
      &lt;all-permissions /&gt;
  &lt;/security&gt;
  &lt;resources&gt;
      &lt;j2se version=&quot;1.6+&quot; href=&quot;http://java.sun.com/products/autodl/j2se&quot;
          java-vm-args=&quot;-Xnoclassgc -Xincgc -client -XX:DefaultMaxRAM=208M -Xms64M -Xmx256M -XX:PermSize=32M -XX:MaxPermSize=128M -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=50&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/ikarusClient.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/ikarusDelegators.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/clientRules.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/ruleImps.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/ikarusUtil.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/ikarusResources.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/domain.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/domain_repository.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/domain_service.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/app_repository.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/app_service.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/infrastructure.jar&quot; /&gt;
      &lt;jar href=&quot;jars/ikarus/integration_domain.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jboss_ejb_auth/ejb3-persistence.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jboss_ejb_auth/jboss-ejb3x.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jboss_ejb_auth/jbossall-client.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jasper/commons-beanutils-1.8.0.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jasper/commons-collections-3.2.1.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jasper/commons-digester-1.7.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jasper/commons-logging-1.1.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jasper/iText-2.1.0.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jasper/jasperreports-3.6.0.jar&quot; /&gt;
      &lt;jar href=&quot;jars/jasper/poi-3.2-FINAL-20081019.jar&quot; /&gt;
      &lt;property name=&quot;jnlp.localization&quot; value=&quot;Delhi&quot;/&gt;
  &lt;/resources&gt;
  &lt;application-desc main-class=&quot;com.celebi.ikarus.main.Ikarus&quot; /&gt;
  </code></pre>
  
  <p>Thanks for any help/comment/brain storming.</p>