How to sign a java applet with a CA-signed certificate

Question

I want to sign an applet using netbeans, but i don't want to self-sign it because since the Java 7u51 was released it is considered as unsigned. How do I get a keystore password?

Answer 1

You're asking the wrong question.

1. You need a keypair.
2. You need a CSR.
3. You need to get the CSR signed by a CA.

All this stuff goes into a keystore, and not the one that came with the JDK or JRE. That's a truststore, and has an entirely different purpose.

So, you need to either create a new keystore, with the keytool, in which case you get to choose your own password, or you need to use an existing keystore, typically $HOME/.keystore, in which case you must already know its password.

Then you do:

1. keytool -genkey ...
2. keytool -certreq ...
3. Get the CA to sign the CSR just generated.
4. keytool -importcert ..., importing the signed CSR, using the same alias as at 1-2.

Note that NetBeans has nothing to do with any of this.