title: Java Web Start error when running signed jar with trusted certificates imported into cacerts keystore
body: <p>I used Netbeans IDE to sign my jars.</p>
  
  <p>I signed my jar using a trusted certificate and in the Netbeans UI dialog, entered the keystore details and key alias.</p>
  
  <blockquote>
    <p>Product Version: NetBeans IDE Dev (Build
    nbms-and-javadoc-482-on-20130914) Java: 1.7.0_25; Java HotSpot(TM)
    Client VM 23.25-b01 Runtime: Java(TM) SE Runtime Environment
    1.7.0_25-b16</p>
  </blockquote>
  
  <hr>
  
  <p>Running by clicking the jnlp file, I got a Keystore exception.
  I wondered if the user should manually import the certificates into the Java cacerts keystore as described here <a href="http://docs.oracle.com/javase/tutorial/security/sigcert/index.html#GenCSR" rel="nofollow">http://docs.oracle.com/javase/tutorial/security/sigcert/index.html#GenCSR</a></p>
  
  <p>I did so and got "Certificate was added to keystore". password set by Oracle is: changeit.
  However when I double click on the JNLP file, I get a popup "runtime error. click for details". I do not get any stack trace. The Java console does not show any error as far as I can see, only several lines of 'CacheEntry'.</p>
  
  <p>Why doesn't Web Start/JNLP do something like this so poor user doesn't have to mess around with keytool?</p>
  
  <p>1) jar file contains the certificates in the chain.</p>
  
  <p>2) have entries for the certificates in the JNLP file.</p>
  
  <p>3) when user clicks on jnlp file, Java extracts the certificates and imports them into Java keystore and then runs program.</p>
  
  <p>But more importantly, why isn't my program running? It used to run fine pre-Java 7.21 before they rejected self-signed jars.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>In Java Control Panel, I went to Advanced, and enabled traces for debugging and logging.
  In the Java console, I see</p>
  
  <pre><code>java.lang.SecurityException: invalid SHA1 signature file digest for org/bouncycastle/cert/jcajce/JcaX509CRLHolder.class
      at sun.security.util.SignatureFileVerifier.verifySection(Unknown Source)    
      at sun.security.util.SignatureFileVerifier.processImpl(Unknown Source)
      at sun.security.util.SignatureFileVerifier.process(Unknown Source)
      at java.util.jar.JarVerifier.processEntry(Unknown Source)
      at java.util.jar.JarVerifier.update(Unknown Source) 
      at java.util.jar.JarFile.initializeVerifier(Unknown Source)
  </code></pre>
  
  <p>I also see</p>
  
  <pre><code>ExitException[ 3]com.sun.deploy.net.FailedDownloadException: Unable to load resource: file:/C:/Users/me/Desktop/dist/lib/bcpkix-jdk15on-149.jar
      at sun.plugin2.applet.JNLP2Manager.downloadResources(Unknown Source)
      at sun.plugin2.applet.JNLP2Manager.prepareLaunchFile(Unknown Source)
      at sun.plugin2.applet.JNLP2Manager.loadJarFiles(Unknown Source)
      at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
      at java.lang.Thread.run(Unknown Source)
  </code></pre>
  
  <p>I do see the bcpkix-jdk15on-149.jar in that location.</p>