When we start our application using javaws ourApplication.jnlp, we get this error every third time (exactly this pattern: FAIL, FAIL, SUCCESS, FAIL, FAIL, SUCCESS, ...):
"JAR resources in JNLP file are not signed by the same certificate". This is how it looks:
Sometimes, we see a JavaFX certificate has expired dialog (the same dialog mentioned below) appearing and then disappearing in a fraction of a second.
I have verified the signature of all windows-related JAR-resources linked by javafx-rt.jnlp. Out of these, all are fine (signed by Oracle with the same certificate) except for two: javafx-rt-lazy-windows-i586__V1.3.1_b101.jar and javafx-rt-fonts-windows-i586__V1.3.1_b101.jar. These two cannot be unzipped by neither jarsigner, 7-zip or Windows 7's built in zip-handler.
One of our users have reported that he gets this error:
"Found unsigned entry in resource: http://dl.javafx.com/1.3/javafx-rt-lazy-window-i586__V1.3.1.jar"
When we don't get this error, we instead get a Warning dialog that the JavaFX certificate has expired. From there we can chose to continue starting our application anyway, and everything works fine.
Some things to note:
- We have cleared Temporary Java Internet Files, uninstalled javaws and removed all certificates, but it doesn't help.
- The JavaFX certificate in the Java Control Panel has expiration date Mon Jan 30 00:59:59 CET 2012. If we delete this, we get back the same one after running our application again.
- These problems happens on Windows, but not on Linux.
It seem that Oracle first updated the certificate to a new one (expiring 2014), but then it got reverted somehow to the old one again (that expired January 2012). Why are some JAR-resources linked by javafx-rt.jnlp corrupt and can this explain why we get the "JAR resources in JNLP file are not signed by the same certificate" error message?