Oracle Java Code Signing Certificates
For developers who are familiar with their use, Code Signing Certificates are an essential tool to assure users who are running your code (including executibles and Java applets) that the code they’re running is safe to download and run. Code signing works by imprinting a piece of code (with Java, often an applet or .jar file) with a unique signature that will break if the code is modified in anyway. If a user tries to then run a piece of signed code that was modified and is now signed with a broken signature, the code will throw up errors and not allow the user to run it at all.
With Java Code Signing Certificates, developers can imprint these digital certificate signatures to digitally sign .jar files and Java applications.
Since most content is now distributed electronically over the web, it is important to make sure that your users do not have warnings that your code is not trusted. Beyond the pure technical function of a code signing certificate and verifying the integrity of your code, code signing certs are also great in that they identify the source of a particular piece of code, that is, they verify to your users that the code they think came from Company XYZ actually was created by Company XYZ.
Code that is not signed with an authentic and trusted code signing certificate from a trusted provider will show users a warning that the “publisher authenticity can not be verified”. In many cases, unsigned code will not run at all. It is important for developers and programmers who are involved with creating code that is intended for distribution to become familiar with the benefits and functions of code signing certificates.
Once you are ready to purchase a certificate, you will want to shop around for the Certificate Authority that is right for you. Certificate Authorities are organizations that have established relationships with software, browser, and operating system developers so that the certificates they issue are automatically trusted.
Self-created code signing certificates can be used, but will not be trusted automatically by the client’s computer.