Managing Java CA Certificate for Applets and Java Web Start

If you deploy an applet or a java web start application and they either communicate back to a https protected web server or is signed with a certificate which CA cert is not part of the standard java CA certificate store, you need to add those CA certificate manually.

First you can customize where the default CA certificate are stored on client machine via a system wide deployment.config file.

Operating System	Location
Windows	C:\Windows\sun\java\Deployment
Solaris, Linux	/etc/.java/deployment/deployment.config
OS X	/Library/Application Support/Oracle/Java/Deployment/deployment.config

Reference: https://docs.oracle.com/javase/8/docs/technotes/guides/deploy/properties.html

In deployment.config contains two properties: deployment.system.config and deployment.system.config.mandatory.

Where the deployment.system.config is the most important and deployment.system.config.mandatory you probably want to set to true (default false). For details about mandatory property see above reference.

deployment.system.config=file:///C:/Windows/Sun/Java/Deployment/deployment.properties
deployment.system.config.mandatory=true

Now we can set the CA configuration in the deployment.properties, lets begin with the system wide properties.

Property Key	Description	Default Value
deployment.system.security.cacerts	"System-level Root CA certificate store." "Signer CA - Certificates of Certificate Authorities (CAs) who issue the certificates to the signers of trusted certificates."	$JAVA_HOME + File.separator + lib + File.separator + security + File.separator + cacerts
deployment.system.security.jssecacerts	"System-level JSSE CA certificate store." "Secure Site CA - Certificates of CAs who issue the certificates for secure sites."	$JAVA_HOME + File.separator + lib + File.separator + security + File.separator + jssecacerts

Then there are user specific

Property Key	Description	Default Value
deployment.user.security.trusted.cacerts	"User-level Root CA certificate store." User: "Signer CA - Certificates of Certificate Authorities (CAs) who issue the certificates to the signers of trusted certificates."	$USER_HOME + File.separator + security + File.separator + trusted.cacerts
deployment.user.security.trusted.jssecacerts	"User-level JSSE CA certificate store." User: "Secure Site CA - Certificates of CAs who issue the certificates for secure sites."	$USER_HOME + File.separator + security + File.separator + trusted.jssecacerts

Reference: https://docs.oracle.com/javase/8/docs/technotes/guides/deploy/properties.html

Reference: https://docs.oracle.com/javase/8/docs/technotes/guides/deploy/jcp.html

IT Security Risk Analysis

Good questions:

• What event could occur (threat event)?
• What could be the potential impact (risk)?
• How often could it happen (frequency)?
• How sure are you about the answer above (certainty)?

IT Security Control Types

Control types can be:

• Administrative (soft control) - documentation, risk management, personnel training.
• Technical (logical control) - software and hardware components
• Physical - fences, guard, swipe cards, locked rooms.

Control types have different functionalities, what they do:

1. Preventive
2. Detective
3. Corrective - fix systems after damage has taken place, e.g. computer image
4. Recovery - data backup
5. Deterrent 
6. Compensating

It is must productive to start with preventing controls, then use detective, corrective and recovery control types.

Compensating is the last resort, when a company for example think that hiring guard is to expensive, so they instead put up fences around building.

IT Security Definitions

Vulnerability - is a weakness which allows an attacker to reduce a system's security

Threat - a possible danger that someone exploits a vulnerability.

Risk - the likelihood that someone exploits a vulnerability.

Exposure - a vulnerability exposes an organization to damages.

Control/Countermeasure/Safeguard - mechanism put in place to mitigate (reduce) the potential risk.

The Main Goals of IT Security

The main goals of IT security are, CIA:

• Confidentiality
• Integrity
• Availability

Confidentiality - Prevent unauthorized disclosure. This must be enforced when data is in rest (data encrypted and not readable by unauthorized persons), in process (securely handled by server or client) and in transit (sent securely over network).

Integrity - Data consistency and not modified by unauthorized person. This must be upheld when data is in rest (not altered by db admin e.g.), in process (altered by e.g. trojan on server) and in transit (man in the middle attack)

Availability - information is timely accessible by authorized persons.

Different organizations value these goals differently.
Some value more Confidentiality (keeping secret secrets), e.g. military secrets or company trade secrets.
Other upholding Integrity, e.g. financial transaction values.
And other value more Availability , e.g. e-commerce web sites.

What is a signed jar file?

First a jar file is a zip file. When signing a jar file, a signature is created for each class in the jar file and added to the jar file in the below files.

META-INF/MANIFEST.MF
META-INF/your-name.SF

Then is a signature for the entire file also added and is placed at the beginning of the .SF file.

The signature certificate and it's ca certificate is also added to the jar and is placed in

META-INF/your-name.RSA

To read the signature use openssl.

openssl pkcs7 -in YOURNAME.RSA -inform DER -text -print_certs -noout

And to test your signed jar and get information about used signature.

jarsigner -verify -verbose your-jar.jar

Decompile and Analyze Java JAR Dependency

Sometime you need to decompile Java or entire JAR files, then JD-GUI is a good tool.

And if you need to find dependencies between JAR files Class Dependency Analyzer (CDA) is a good tool. Please see screenshot at their homepage.