I have posted this problem on some Mac forums, but after being met with silence, I decided I would turn to the Java community to see if I could find an answer:
I have developed a website archive which is privately distributed as a stand alone archive to be run locally on the user's computer (no server). It uses Lucene search engine (Java) to search the archive; the search API/applet is packaged in a jar file and the jarfile/applet is self-signed.
In order to do the search, a self-signed certificate is created for the search applet, since the files in the archive it is searching are on the user's hard drive. After the initial installation of the archive, and upon the first search initiated, the security window pops up asking the user permission for the user to run the applet.
The problem lies here:
With Windows and all versions of Mac OS X prior to 10.7 (Lion), the user can check "always trust" (or similar), and from then on, subsequent searches are carried out without prompting the user to accept the certificate (even after restarting the browser application)
However, on Lion, the user can run the applet only once, and will continue to get a security prompt on every search afterwards, even though "always trust" is checked. Not only that, often the user gets three prompts in a row before the applet will run (it actually works better to NOT check "always trust", where you will only get one prompt).
This behaviour occurs whether using Firefox or Safari, so it is apparent this is System related, not a browser issue.
I attempted to manually import the certificate both into the Keychain Access, and also into Authorities under Firefox's certificate manager (see http://www.clintharris.net/2009/self-signed-certificates/). This however was not successful.
Some possibilities I have considered are: There is no publisher name for a self-signed cert (though this never was a problem before). As far as importing the certificate, could it be that because the archive is local (url = file://) that it won't recognize it?
Does anyone know what is happening here, or can suggest a work-around for this (besides paying for a "trusted" CA). Everything worked just hunky-dory -- until Lion...
I don't know why Safari and Mac OSX have the observed behaviour but I do think that using an Applet is the wrong technology. Since you distribute the Applet Jar file to each computer it would seem more logical to just use a Java Application.
The applet is only used to pass parameters and initiate the Java app that does the actual search. The reason for using the applet is to keep everything in the browser, and avoid the very large inconvenience of launching a separate application to search an archive that is displayed in a browser.
I am not familiar with any way of doing this that would not require certification, since it is running in a sandbox.
I have observed that if I attempt to load the applet from a webserver, a different security prompt appears, giving the option to always accept content from the particular site, or if I go into advanced options, can choose to always accept content with the same signature. When I do this, it behaves as desired.
So it appears the problem only reveals itself when the applet is located on the local filesystem. I do not know why such a distinction should be made.
Edited by: Allasso Travesser on Feb 23, 2012 5:28 AM