title: "Your security settings have blocked a self-signed application from running" with a real pfx signed jar
body: <p>I actually jarsign a java applet with this command :</p>
  
  <pre><code>jarsigner -storetype pkcs12 -keystore my_real_certificate.pfx my_applet.jar my_alias_certificate -storepass my_password
  </code></pre>
  
  <p>When I launch my applet, I get the following error :</p>
  
  <blockquote>
    <p>Your security settings have blocked a self-signed application from running</p>
  </blockquote>
  
  <p>When I want to verify the jar, the result appears as following :</p>
  
  <blockquote>
    <p>jar verified.</p>
    
    <p>Warning: This jar contains entries whose signer certificate's
    ExtendedKeyUsage extension doesn't allow code signing. This jar
    contains entries whose certificate chain is not validated. This jar
    contains signatures that does not include a timestamp. Without a
    timestamp, users may not be able to validate this jar after the
    signer certificate's expiration date (2017-05-22) or after any future
    revocation date.</p>
  </blockquote>
  
  <p>For this warning :</p>
  
  <blockquote>
    <p>This jar contains entries whose signer certificate's
    ExtendedKeyUsage extension doesn't allow code signing</p>
  </blockquote>
  
  <p>I guess my certificate is not proper for jarsigning code. Could you tell me if this kind of warning would get me that kind of error on the client ? Or could I still use this certificate ?</p>
  
  <p>For this warning :</p>
  
  <blockquote>
    <p>This jar contains entries whose certificate chain is not validated.</p>
  </blockquote>
  
  <p>I don't understand because my certificate was really validated by a CA (Thawte). Should I indicate to Java or into my Windows certificate manager the complete certificate chain (with CA Root and intermediate) ? If so, what happens for the users of this applet ? Should they also do this ?</p>
  
  <p>Thanks in advance for your answers.</p>