title: Signed JAR being blocked by Java Security
body: <p>I'm racking my brains as to why when I'm signing my JAR using a code signing certificate which has been used before, I still get a Java Security Application Blocked dialog which stipulates that my application is self-signed:</p>
  
  <p><a href="https://i.stack.imgur.com/PtXLU.png" rel="noreferrer"><img src="https://i.stack.imgur.com/PtXLU.png" alt="enter image description here"></a></p>
  
  <p>However, when I run the jarsigner verify command from a machine that I didn't use to sign the app (replaced actual company name with Acme for anonymity):</p>
  
  <pre><code>jarsigner -verify -certs -verbose RegistrySafeLauncher.jar
  
  
  s        821 Wed Oct 21 09:25:42 BST 2015 META-INF/MANIFEST.MF
  
        X.509, CN="Acme Software, Inc.", OU=Acme Software Corp, OU=Digital ID Class 3 - Java Object Signing, O="Acme Software, Inc.", L=Sunnyvale, ST=California, C=US
        [certificate is valid from 11/5/13 12:00 AM to 11/4/16 11:59 PM]
        X.509, CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 2/8/10 12:00 AM to 2/7/20 11:59 PM]
        X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 11/8/06 12:00 AM to 11/7/21 11:59 PM]
        X.509, OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
        [certificate is valid from 1/29/96 12:00 AM to 8/3/28 12:59 AM]
  
           561 Wed Oct 21 09:25:42 BST 2015 META-INF/MYKEY.SF
          5345 Wed Oct 21 09:25:42 BST 2015 META-INF/MYKEY.RSA
             0 Wed Oct 21 09:25:44 BST 2015 META-INF/
             0 Wed Oct 21 09:25:44 BST 2015 registrysafelauncher/
  sm      1067 Wed Oct 21 09:25:42 BST 2015 META-INF/INDEX.LIST
  
        X.509, CN="Acme Software, Inc.", OU=Acme Software Corp, OU=Digital ID Class 3 - Java Object Signing, O="Acme Software, Inc.", L=Sunnyvale, ST=California, C=US
        [certificate is valid from 11/5/13 12:00 AM to 11/4/16 11:59 PM]
        X.509, CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 2/8/10 12:00 AM to 2/7/20 11:59 PM]
        X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 11/8/06 12:00 AM to 11/7/21 11:59 PM]
        X.509, OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
        [certificate is valid from 1/29/96 12:00 AM to 8/3/28 12:59 AM]
  
  sm      1441 Wed Oct 21 09:25:44 BST 2015 registrysafelauncher/RegistrySafeLauncher$1.class
  
        X.509, CN="Acme Software, Inc.", OU=Acme Software Corp, OU=Digital ID Class 3 - Java Object Signing, O="Acme Software, Inc.", L=Sunnyvale, ST=California, C=US
        [certificate is valid from 11/5/13 12:00 AM to 11/4/16 11:59 PM]
        X.509, CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 2/8/10 12:00 AM to 2/7/20 11:59 PM]
        X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 11/8/06 12:00 AM to 11/7/21 11:59 PM]
        X.509, OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
        [certificate is valid from 1/29/96 12:00 AM to 8/3/28 12:59 AM]
  
  sm      1765 Wed Oct 21 09:25:44 BST 2015 registrysafelauncher/RegistrySafeLauncher.class
  
        X.509, CN="Acme Software, Inc.", OU=Acme Software Corp, OU=Digital ID Class 3 - Java Object Signing, O="Acme Software, Inc.", L=Sunnyvale, ST=California, C=US
        [certificate is valid from 11/5/13 12:00 AM to 11/4/16 11:59 PM]
        X.509, CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 2/8/10 12:00 AM to 2/7/20 11:59 PM]
        X.509, CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
        [certificate is valid from 11/8/06 12:00 AM to 11/7/21 11:59 PM]
        X.509, OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
        [certificate is valid from 1/29/96 12:00 AM to 8/3/28 12:59 AM]
  
  
    s = signature was verified 
    m = entry is listed in manifest
    k = at least one certificate was found in keystore
    i = at least one certificate was found in identity scope
  
  jar verified.
  
  Warning: 
  This jar contains signatures that does not include a timestamp. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2016-11-04) or after any future revocation date.
  </code></pre>
  
  <p>And the manifest file in the built JAR looks like this:</p>
  
  <pre><code>Manifest-Version: 1.0
  Ant-Version: Apache Ant 1.9.4
  X-COMMENT: Main-Class will be added automatically by build
  Application-Library-Allowable-Codebase: *.acme.net http://localhost*
  Application-Name: RegistrySafeLauncher
  Class-Path: lib/jna-4.2.0.jar lib/jna-platform-4.2.0.jar
  Permissions: all-permissions
  Created-By: 1.7.0_80-b15 (Oracle Corporation)
  Caller-Allowable-Codebase: *.acme.net http://localhost*
  Main-Class: registrysafelauncher.RegistrySafeLauncher
  Codebase: *
  
  Name: registrysafelauncher/RegistrySafeLauncher.class
  SHA-256-Digest: lA2UH1iNCFqmNeXTlD/5Gik+DGfkA64F34T3i6ArSEM=
  
  Name: registrysafelauncher/RegistrySafeLauncher$1.class
  SHA-256-Digest: kNyCx9f9FwWHAV/Mf4D+9KIJJfFHdcrTUNnEdiXwWmw=
  
  Name: META-INF/INDEX.LIST
  SHA-256-Digest: 7A/Nhqqvf7wBQNaAj0actnzwuWocUJv6R8/+QZyURmw=
  </code></pre>
  
  <p>What am I missing? Am I missing something in my manifest file or is the link to the CA (VeriSign) not right on the machine I'm building on?</p>
  
  <p>****** Later update: ******</p>
  
  <p>After playing around with my jnlp file so that it looks like this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="no"?&gt;
  &lt;jnlp codebase="http://localhost/jnlptestcaller" href="launch.aspx" spec="1.0+"&gt;
      &lt;information&gt;
          &lt;title&gt;RegistrySafeLauncher&lt;/title&gt;
          &lt;vendor&gt;Acme Software, Inc.&lt;/vendor&gt;
          &lt;homepage href=""/&gt;
          &lt;description&gt;RegistrySafeLauncher&lt;/description&gt;
          &lt;description kind="short"&gt;RegistrySafeLauncher&lt;/description&gt;
      &lt;/information&gt;
      &lt;update check="background"/&gt;
      &lt;security&gt;
  &lt;all-permissions/&gt;
  &lt;/security&gt;
      &lt;resources&gt;
          &lt;j2se version="1.7+"/&gt;
          &lt;jar href="RegistrySafeLauncher.jar" main="true"/&gt;
          &lt;jar href="lib/jna-4.2.0.jar"/&gt;
          &lt;jar href="lib/jna-platform-4.2.0.jar"/&gt;
      &lt;/resources&gt;
      &lt;application-desc main-class="registrysafelauncher.RegistrySafeLauncher"&gt;
          &lt;argument&gt;JavaAgent.jnlp.aspx&lt;/argument&gt;
      &lt;/application-desc&gt;
  &lt;/jnlp&gt;
  </code></pre>
  
  <p>I now get this slightly different security warning:</p>
  
  <p><a href="https://i.stack.imgur.com/n9UZ8.png" rel="noreferrer"><img src="https://i.stack.imgur.com/n9UZ8.png" alt="Java Security Blocked"></a></p>
  
  <p>How can I get rid of this warning?</p>