This article describes how Java ^TM ME MIDlets can be signed for Sony Ericsson mobile phones, which certificates to use and how to avoid any pitfalls.

Background

Commonly Java ME application signing is just used to remove the system prompts that are displayed for the user when the application does access different protected APIs like the Internet, file system or the camera and so on. It's true that signing of the application can do this but signing is not only about better user experience and usability of the application it is also about security and credibility.

Signing keeps the integrity of the application

Developer - Knows that no one can make any changes to the application without ruin the signature in the Jad file.

Sales channel - Can trust the submitted content and knows that the content is the original one distributed from the developer.

Customer - User can see that the application is signed and what company has signed it which brings credibility.

Certificates

When signing a MIDlet it must be signed against any of the Java root certificates available in the Sony Ericsson phones. It is not possible to install a self made root certificate.

On Sony Ericsson phones the most common third-party certificates that should be used when signing are:

• GeoTrust CA for UTI

• Thawte Premium Server CA

• VeriSign Class 3

Note that the only one that always will be available in all Sony Ericsson MIDP2 phones is the GeoTrust CA for UTI certificate, this is the certificate used by Java Verified^TM

In all Sony Ericsson phones it is possible to see which Java root certificates are available.

Commonly seen in the Security -> Certificates menu.

Certificate life span

A Thawte or VeriSign certificate is commonly purchased with a validity period of 1-3 years. When using Java Verified the certificate signature will be valid for 10 years.

This has caused the Thawte and VeriSign certificate to be popular for signing during the development process.

It's important to know that the signing of the application will have the same expiration date as the certificate the application was signed with. If the certificate has expired it will not be possible to install the application. The expiration date is only checked at install time so an install application will not expire.

Java Verified

Java Verified is an industry driven testing and signing program supported by Sony Ericsson.

Using Java Verified the application will go though testing and if the testing is successful the MIDlet will be signed with the UTI certificate. The UTI certificate is the only certificate for Java ME applications available in all Sony Ericsson phones.

Test Labs use in the Java Verified program are:

1. Babel Media

2. NSTL

3. RelQ

4. Sogeti

Applications certified though the Java Verified Program are eligible to use the Java Powered logo.

Read more here >>> http://developer.sonyericsson.com/javaverified

Register and submit application for testing here >>> http://www.javaverified.com/

Certificate Authority (CA)

A certificate authority is the legal entity managing root certificates. Before purchasing any code signing certificates from the CA make sure the corresponding root certificate is available in the phone.

VeriSign

http://www.verisign.com/

Thawte

http://www.thawte.com/

Tools

keytool.exe

The keytool is a command based tool used to manage keystores. The keystore is used to sign the MIDlet.

The keytool is included in the Java SE development kit.
Program Files\Java\jdk1.6.0_02\bin

• By using the tool a private and public key can be created.

• The certificate request .cer sent to the CA requesting the certificate can be created.

• Used to import certificates into the keystore.

Sign MIDlet utility

In the Sony Ericsson WTK the Sign MIDlet tool is used to mange keystores and sign MIDlets.

• New Key Pair - Create a new private and public key in the keystore used by the tool.

• Generate CSR - Create the certificate request sent to the CA requesting the certificate.

• Import Certificate - Import the certificate received by the CA to the keystore.

• Sign MIDlet Suite - After the certificate is imported the MIDlet can be signed.

Acquire a code signing certificate - An example

1)

Use the keytool.exe or the Sign MIDlet Suite tool to generate a new private and public key.

keytool -genkey -alias mykey -keyalg RSA -keystore mykeystore.sks

Note. Only registered companies can request certificates and make sure to write the full company name in the Organization field.

The third-party security domain should be used.

2)

Create the certificate request.

keytool -certreq -alias mykey -keystore mykeystore.sks -file mykey.csr

3)

Select Certificate Authority

VeriSign: http://www.verisign.com/

Thawte: http://www.thawte.com/

The UTI certificate is only available though Java Verified.

Find where to apply for a Java Code signing certificate.

During the registration process the certificate request should be submitted.

-

BEGIN NEW CERTIFICATE REQUEST----

MIIB0jCCATsCAQAwgZExCzAJBgNVBAYTAlNFMQ8wDQYDVQQIEwZTd2VkZW4xDjAMBgNVBAcTBUtp

c3RhMS8wLQYDVQQKEyZTb255IEVyaWNzc29uIE1vYmlsZSBDb21tdW5pY2F0aW9ucyBBQjEYMBYG......................................n

-

END NEW CERTIFICATE REQUEST----

4)

One the certificate request has been approved by the CA the certificate will be available for download. The certificate should be downloaded in PKCS #7 format. The certificate can be saved using notepad and stored as mycert.txt

-

BEGIN PKCS #7 SIGNED DATA----

DjAMBgNVBAcTBUtp

c3RhMS8wLQYDVQQKEyZTb255IEVyaWNzc29uIE1vYmlsZSBDb21tdW5pY2F0aW9ucyBBQjEYMBYG......................................n

-

END PKCS #7 SIGNED DATA----

5)

Import the certificate in the keystore.

keytool -import -file mycert.txt -alias mykey -keystore mykey.sks

If a key pair is located in another keystore the keys can be imported to the keystore used by the Sign MIDlet Utility by selecting the Import Key Pair button. Can be used if the key pairs was created using the keytool but rather using the Sign MIDlet Utility to sign the MIDlet.

6)

Once the key pair and the certificate are located in the key store the key store can be used to sign a MIDlet suite.

IMPORTANT - Before signing the MIDlet make sure to add the appropriate permissions to the JAD file and MANIFEST file.

Use the Sign MIDlet Utility simply by pressing Sign MIDlet Suite button and select the JAD file.

The Java JadTool can also be used to sign the MIDlet simply by using the two commands to first add the certificate to the JAD file and after that add the signature to the JAD file.

Note that the certificate and signature is located in the JAD file so a signed application must be installed using the JAD file, other wise it will be installed as unsigned.

On Sony Ericsson phones there are a few ways to install an application using the JAD file.

Over The Air (OTA) - Put the application, JAD and JAR, on a web server and use the browser in the phone to download the MIDlet.

Local - Copy the JAD and JAR to the phones file system. On the phone, select the JAD file to install the application.

Device Explorer - In the Sony Ericsson SDK for the Java ME Platform a tool called Device Explorer can be used to install the application to the phone.

In all these cases make sure to select the JAD file.

Permission Settings

Find a list of permission settings used on Sony Ericsson phones here >>> http://developer.sonyericsson.com/getDocument.do?docId=99421

It is not possible to specify the default setting for a MIDlet before the MIDlet is installed. The permission setting can be changed for each application once it is installed. This is done in the settings menu for each MIDlet.

From Sony Ericsson JP8 phones it is possible to specify default permission levels, specifying the Trusted permission level will sett all available security settings to the least restritcted available.

||||

On the newest Sony Ericsson Java^TM ME phones the permission setting can be changed at runtime when the user is prompted for permission to use the API.

Permission Attributes

Some APIs do require permission to execute, for a signed MIDlet the permission should be entered in the JAD and MANIFEST file before signing. This can commonly be done by the IDE.

Jad / MANIFEST attribute:

MIDlet-Permissions: javax.microedition.io.PushRegistry, javax.microedition.io.Connector.sms

Find a list of permission attributes here >>> http://developer.sonyericsson.com/community/docs/DOC-1049

FAQ

My MIDlet is Signed but the installation fails?

1) Make sure the correct date is set in the phone; the certificate is only valid for a certain period of time.

2) Make sure the used certificate is available in the phone.

-

After my signed MIDlet is installed I can't connect to the Internet using an HttpConnection.

For an API requiring permission the permission should be added to the JAD and MANIFEST file before the MIDlet is signed.

MIDlet-Permissions: javax.microedition.io.Connector.http

-

My MIDlet is signed and I have added the permission to use a socket connection but I still get a security exception?

Some operators do now allow third-party signed applications to use all APIs. Check if you are using an operator branded phone.

-

I have a signed MIDlet but the installation fails?

Make sure the certificate the MIDlet is signed with is available in the phone.

Find out what certificate is used to sign the MIDlet in the JAD file.

MIDlet-Certificate-1-1: MIIDSjCCAjKgAwIBAg...........................n

1) Copy the MIDlet-Certificate attribute value.

2) Create a text file using notepad and copy the value into that file.

3) Rename the text file to be a .cer file

4) Open the .cer file to be able to read the certificate information.

-

Further Reading

Have questions? Look in the forum.

You can browse other articles on this subject using the tags below.