Starting with Java SE 7 Update 21 in April 2013 all Java Applets and Web Start Applications are encouraged to be signed with a trusted certificate. And starting with 7u25, all files must be added to JARs prior to signing.

Overview

During the February 19, 2013 Java Critical Patch Update (CPU)1, Oracle announced its intentions to deliver a new Java CPU release, Oracle Java SE 7 Update 21 (Java SE 7u21), on April 16, 2013. Along with delivering security remediation, Java SE 7u21 will also deliver some key security features. Most significant is a new requirement that all Java applets and Web Start Applications using the Java plug-in to run in browsers be signed with a trusted certificate for the best user experience. Java supports code signing, but until Java SE 7u21 it was an optional feature. Application code signing provides numerous security benefits to users.

Java SE 7u21 will introduce changes to security levels on the security slider within the Java Control Panel. Authors and vendors of applications deployed using either Java applets or Java Web Start technology – applications distributed to end users at runtime via the web browser or network - should sign their code using a trusted certificate for the best user experience. Specifically, all Java code executed within the client’s browser will prompt the user. The type of dialog messages presented depends upon risk factors like, code signed or unsigned, code requesting elevate privileges, JRE is above or below the security baseline, etc. Low risk scenarios present a very minimal dialog and include a checkbox to not display similar dialogs by the same vendor in the future. Higher risk scenarios, such as running unsigned jars, will require more user interaction given the increased risk.

Even the smallest changes in user experience are sometimes troublesome. We have considered how changes affect user experience. Given the current climate around Java security in the browser, code signing is a valuable security control for protecting Java users.