对Java Applet进行签名，使其可以在OS X 10.8 Mountain Lion和Windows上运行

Question

I develop an Java Applet that needs to break out of the sandbox so it is signed by a certificate from a trusted CA (Thwate). This has worked well on OS X, Windows and Linux. Now with OS X 10.8 (Mountain Lion) I have this issue: OS X 10.8 Gatekeeper and Java applets

It seams like OS X 10.8 require a signed applet to be signed with an Apple Developer ID Certificate.

My question is: If I change so that the applet is signed by a Apple Developer ID Certificate will this also work on windows/linux etc? If not, how can I have a signed applet which signature validates fine on all major OS? Can I sign the applet with two certificates?

Answer 1

The answer to this question has now been posted in the linked question above: OS X 10.8 Gatekeeper and Java applets

Basically it can't be solved. I have tried to export the Developer ID Application certificate to a .p12 certificate and tried to sign the applet with that in addition to the certificate from Thwate since it is allowed to sign a jar/applet with more than one identity. The applet gets signed but jarsigner can't verify the signature.

So the ways to get rid of this bad warning message is that the user of the signed Applet does one of the following:

1. Changes his GateKeeper settings to allow applications "from anywhere".
2. Upgrades to Java 7 which is developed by Oracle and works as Java has done previously on OS X, ie a certificate from Thwate is enough.
3. Adds the Thwate certificate to his keychain.