<p>I'm looking around for a Java <a href="http://en.wikipedia.org/wiki/Code_signing" rel="noreferrer">code signing</a> certificate so my Java applets don't throw up such scary security warnings. However, all the places I've found offering them charge (in my opinion) way too much, like over USD200 per year. While doing research, a code signing certificate seems almost exactly the same as an <a href="http://en.wikipedia.org/wiki/SSL" rel="noreferrer">SSL</a> certificate.</p>

<p>The main question I have: is it possible to buy an SSL certificate, but use it to sign Java applets?</p>

[{'answer_id': 78889, 'author': 'John Meagher', 'author_id': 3535, 'author_profile': 'https://Stackoverflow.com/users/3535', 'pm_score': 6, 'selected': True, 'text': "<p>Short answer: No, they're different.</p>\n\n<p>Long answer: It's the same sort of certificate and it uses the same crypto software, but the certificate has flags indicating what it is allowed to be used for.  Code signing and web server are different uses.  </p>\n"}, {'answer_id': 78925, 'author': 'Purfideas', 'author_id': 4615, 'author_profile': 'https://Stackoverflow.com/users/4615', 'pm_score': 2, 'selected': False, 'text': '<p>When I import a new CA certificate in Firefox (etc.) I have the option of choosing which certificate uses I trust:</p>\n\n<ul>\n<li>Sign servers</li>\n<li>Sign code (like your applet)</li>\n<li>Sign email certificates</li>\n</ul>\n\n<p>So to me the answer is: Yes, they\'re the same. Furthermore, why not generate your own with <a href="http://en.wikipedia.org/wiki/OpenSSL" rel="nofollow noreferrer">OpenSSL</a>  (man openssl, man x509, man req, etc. on Unix)? Do you want to just quiet down the warnings <em>or</em> do you want <em>other</em> people whom you\'ve never met to trust your code? If you don\'t need other users to chain trust to the anchor CA\'s bundled with their browser, OS, etc., then use OpenSSL to generate your own.</p>\n\n<p>And ask "How do I use OpenSSL to generate my own certificates?" if the latter is your choice.</p>\n'}, {'answer_id': 78931, 'author': 'jtimberman', 'author_id': 7672, 'author_profile': 'https://Stackoverflow.com/users/7672', 'pm_score': 1, 'selected': False, 'text': '<p>Thawte offers code signing certificates <a href="http://www.thawte.com/code-signing/" rel="nofollow noreferrer">here</a>. I imagine other Certificate Authorities offer this service as well. You can also create self-signed certificates, with <a href="http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/keytool.html" rel="nofollow noreferrer">Java keytool</a>.</p>\n'}, {'answer_id': 27676751, 'author': 'flup', 'author_id': 1973271, 'author_profile': 'https://Stackoverflow.com/users/1973271', 'pm_score': 1, 'selected': False, 'text': '<p>X.509 certificates may include <a href="https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3" rel="nofollow noreferrer">key usage fields</a> (KU\'s) and <a href="https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12" rel="nofollow noreferrer">extended key usage fields</a> (EKU\'s). The <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/deploy/certificates.html#A1148308" rel="nofollow noreferrer">Oracle tech note describing how to create sign your RIA\'s</a> creates a certificate without any key usage flags, which works just fine (if you can get a trusted CA to sign it)</p>\n<p>But more and more, CA\'s issue certificates with these key usage fields. When present, these fields <strong>restrict</strong> the usage of the certificate. The java plugin checks for the presence of these fields in the <a href="http://www.docjar.com/html/api/sun/security/validator/EndEntityChecker.java.html" rel="nofollow noreferrer">EndEntityChecker</a>:</p>\n<pre><code>/**\n * Check whether this certificate can be used for code signing.\n * @throws CertificateException if not.\n */\nprivate void checkCodeSigning(X509Certificate cert)\n        throws CertificateException {\n    Set&lt;String&gt; exts = getCriticalExtensions(cert);\n\n    if (checkKeyUsage(cert, KU_SIGNATURE) == false) {\n        throw new ValidatorException\n           (&quot;KeyUsage does not allow digital signatures&quot;,\n            ValidatorException.T_EE_EXTENSIONS, cert);\n    }\n\n    if (checkEKU(cert, exts, OID_EKU_CODE_SIGNING) == false) {\n        throw new ValidatorException\n            (&quot;Extended key usage does not permit use for code signing&quot;,\n            ValidatorException.T_EE_EXTENSIONS, cert);\n    }\n\n    if (!SimpleValidator.getNetscapeCertTypeBit(cert, NSCT_SSL_CLIENT)) {\n        throw new ValidatorException\n            (&quot;Netscape cert type does not permit use for SSL client&quot;,\n            ValidatorException.T_EE_EXTENSIONS, cert);\n    }\n\n    // do not check Netscape cert type for JCE code signing checks\n    // (some certs were issued with incorrect extensions)\n    if (variant.equals(Validator.VAR_JCE_SIGNING) == false) {\n        if (!SimpleValidator.getNetscapeCertTypeBit(cert, NSCT_CODE_SIGNING)) {\n            throw new ValidatorException\n                (&quot;Netscape cert type does not permit use for code signing&quot;,\n                ValidatorException.T_EE_EXTENSIONS, cert);\n        }\n        exts.remove(SimpleValidator.OID_NETSCAPE_CERT_TYPE);\n    }\n\n    // remove extensions we checked\n    exts.remove(SimpleValidator.OID_KEY_USAGE);\n    exts.remove(SimpleValidator.OID_EXTENDED_KEY_USAGE);\n\n    checkRemainingExtensions(exts);\n}\n</code></pre>\n<p>The check methods look as follows:</p>\n<pre><code>/**\n * Utility method checking if the extended key usage extension in\n * certificate cert allows use for expectedEKU.\n */\nprivate boolean checkEKU(X509Certificate cert, Set&lt;String&gt; exts,\n        String expectedEKU) throws CertificateException {\n    List&lt;String&gt; eku = cert.getExtendedKeyUsage();\n    if (eku == null) {\n        return true;\n    }\n    return eku.contains(expectedEKU) || eku.contains(OID_EKU_ANY_USAGE);\n}\n</code></pre>\n<p>So if no KU or EKU is specified, the KU or EKU checker happily returns true.</p>\n<p>But</p>\n<ul>\n<li>if KU\'s are specified, the <em>digital signature</em> KU should be one of them.</li>\n<li>if any EKU\'s are specified, either the EKU <em>code signing</em> (identified by oid 1.3.6.1.5.5.7.3.3) or the EKU <em>any usage</em> (identified by oid 2.5.29.37.0) should be specified as well.</li>\n</ul>\n<p>Finally, the <code>checkRemainingExtensions</code> method checks the remaining critical EKU\'s. The only other  critical EKU\'s allowed to be present are</p>\n<ul>\n<li><em>basic constraints</em> (oid &quot;2.5.29.19&quot;) and</li>\n<li><em>subject alt name</em> (oid 2.5.29.17)</li>\n</ul>\n<p>If it finds any other critical EKU, it returns false.</p>\n'}]
['https://Stackoverflow.com/questions/78869', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/14569/']