Allowing unsigned Java applications on all sites

javajava-appletjre

Java stopped running unsigned applications one day.

Your security settings have blocked an untrusted application from running.

Java security useless error message

The documentation states that I can add a site to an exception list to get around this problem. However, I am trying to run a Java applet for WebSDR usage, and there are many sites with many applets needed. It's a real hassle to have to do this, especially when I'm using Chrome and it already prompts me before running Java at all.

Java has become almost completely useless to me, and I'd like to fix that by toning down the security a bit. Is it possible to either disable the blocking of unsigned apps, or add a wildcard of URLs to the exception list? I've tried adding * or http://, but the "Configure Java" panel won't except either of these.

Best Answer

Java 8u25

Warning: These settings expose security vulnerabilities known to Java. Not for the the average user.

I was having a lot of tools blocked by Java. I set the options below and then added to the site exception list. I was then able to run all of my older applets that were previously blocked after a browser restart.

Advanced:

**JNLP File/MIME Association - Always allow

**Secure Execution Environment - Uncheck Show sandbox warning banner, uncheck warn if site certificate does not match hostname, uncheck show site certificate from server even if it is valid

**Mixed code - Disable verification

**Perform certificate revocation checks on - Do not check

**Advanced Security Settings - Uncheck enable blacklist revocation check

Security:

**Add the site to Security tab > edit site list > add button > type URL or IP.

But you can use a deployment rule set

I'll summarize the steps but you have to read the full guide anyway

Create an ANSI encoded text file and name it ruleset.xml

Build your content and add any site:port you need. It seems wildcards are allowed here.

<ruleset version="1.0+">
        <rule>
        <id location="http://1.1.1.1:*" />
        <action permission="run" />
    </rule>
    <rule>
        <id />
        <action permission="block" />
    </rule>
</ruleset>

Download the Java JDK, copy the ruleset.xml file to the bin folder of the JDK install location, where the jar.exe file is.
Open a command prompt and cd to the location of jar.exe and ruleset.xml. Type in this command:
```
jar -cvf DeploymentRuleSet.jar ruleset.xml
```
Now you need to sign the deployment ruleset. For that, you need a java keystore with a cert in it that is trusted on your computer.

One way to generate a keystore is to use keytool.exe which is in C:\Program Files\Java\jre6\bin together with this command

keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048

To extract the certificate from the keystore, use
```
keytool -exportcert -keystore keystore.jks -alias selfsigned -file Cert.cer
```
And then you can install this cert into the trusted root CA (Guide)
If your certificate has an extension of .pfx, just rename it to .p12
Use keytool to import the .p12 file

Keytool -importkeystore -deststorepass password -destkeystore Keystore.jks -srcKeystore Cert.p12 -srcstoretype pkcs12 -srcstorepass password

You’ll want to change the -srcstorepass to the password of your certificate

You should get something that says "Entry for alias…". After the word alias is the alias of the keystore, which you will need. (long GUID)
Now that you have a keystore with a trusted certificate in it, you can use that to sign the jar file.

To do this, open a command prompt in the jdk bin folder and type:

jarsigner -verbose -keystore keystore.jks -signedjar DeploymentRuleSet.jar DeploymentRuleSet.jar selfsigned

Change "selfsigned" to the alias you had from step 7
Now, put the DeploymentRuleSet.jar file in one of these directories:
- Windows: c:\Windows\Sun\Java\Deployment.
- Mac, Linux, Unix: /etc/.java/deployment

That's it. Easy, huh?

You can verify if the DeploymentRuleSet is in place by going to the Java console in control panel and clicking the security tab. Click on “View the active Deployment Rule Set”

Sources

Please note that

If an active deployment rule set is installed on the system, the deployment rules take precedence over the exception site list.

^Source

Best Answer

Related Solutions

Run unsigned Java applets

About adding many sites with only different ports to Java Exception Site List

But you can use a deployment rule set

Sources

Related Question