RE-SIGNING EMC DOCUMENTUM APPLETS USING CUSTOM SECURITY CERTIFICATES

Transcription

1 White Paper RE-SIGNING EMC DOCUMENTUM APPLETS USING CUSTOM SECURITY CERTIFICATES Abstract This white paper outlines the procedure to digitally sign Java applets that have expired security certificates. EMC Documentum Webtop uses applet/servlet technology that enables content transfer between the client machine and content repository. As a security measure an applet gains access to a local machine only if it is trusted or signed code. Since the content transfer operation involves interaction with the client system, we sign our applets with digital security certificates. This paper provides instructions to sign applets using your own security certificates obtained from trusted certification authorities. March 2011

2 Copyright 2011 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate of its publication date. The information is subject to change without notice. The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. All other trademarks used herein are the property of their respective owners. Part Number h8201 2

3 Table of Contents Executive summary... 4 Audience... 4 Re-signing Documentum applets using custom security certificates... 4 Prerequisites... 4 Process for re-signing applets... 4 Signing WDK and Webtop applet files... 6 Conclusion... 7 References

4 Executive summary This white paper enables customers who want to re-sign applets that have expired certificates to use certificates procured from a certification authority of their choice, in place of the EMC certificate that is procured from Thawte, a certification authority (CA). The paper outlines generic steps to re-sign EMC applets using custom code. Customers who place a high level of importance on security by not trusting code that interacts with the client machine must sign EMC Documentum applets with certificates from a trusted CA in keeping with the policy enforced by the their organization. Audience This white paper is intended for technical support personnel to share the instructions provided with customers who want to re-sign Documentum applets using custom certificates. Re-signing Documentum applets using custom security certificates You can opt to digitally re-sign your applets that have expired certificates with the help of a trusted certification authority. Prerequisites J2SDK 1.4 or later Signing tools such as jarsigner from Sun JDK or the Netscape Signing Tool A valid digital certificate verified by a Certification Authority Microsoft signcode for signing cabinet files (MS SDK for Java) The process of re-signing Documentum applets using custom security certificates includes the following steps: 1. Signing applet jar files using jarsigner 2. Signing applet cabinet (.cab) files using Microsoft Authenticode Process for re-signing applets Step 1: Signing applet jar files using the jarsigner Perform the following steps to sign applet jar files using the jarsigner: 1. Create a keystore. Use keytool to create a certificate and store it in keystore. Run the following command to create a certificate and import it into the keystore: 4

5 keytool import trustcacerts keystore <keystore_filename> -alias <alias_name> -file cert.p7b This command imports the response from the CA stored in a file called cert7.db into the keystore as name <alias name>. The name <alias name> must not already exist in the keystore. The -trustcacerts flag notifies keytool to verify the response certificate against the certificates that are shipped with Java 2. If you do not have a verified digital certificate, you can use keytool to generate a public-private key pair, and then generate a certificate signing request (CSR) using keytool. After importing it into the keystore, you can use the certificate for signing applets. 2. Run the following command using the jarsigner to sign the applet (.jar) files: jarsigner -keystore <keystore_filename> <path to appletfiles.jar)> <alias_name> This command signs the jar <appletfiles.jar> using the private key stored in the keystore <keystore_filename> created in Step 1, with the alias as <alias_name> as specified while creating the keystore. When you execute this command, you are prompted to specify the keystore password and the certificate password depending on how the certificate was imported into the keystore. You can pass the storepass and keypass parameters to keytool to store the keystore password as an alternative to using the interactive mode to enter passwords. 3. Run the following command to verify the status of the signed jars in the jar file and check whether the certificate is known (specified through keystore): jarsigner -verify -verbose -certs <path to appletfiles.jar> Personal information encoded in the certificate for the entity that signed the file is listed against each signed file. (If the certificate is known in the keystore by a specific name, that name is listed in parentheses after the certificate's personal information.) Step 2: Signing the applet cabinet (.cab) files using Microsoft Authenticode Perform the following steps to sign the applet cabinet (.cab) files using Microsoft Authenticode. 1. Run the following commands: signcode j javasign.dll jp Low -spc <software publisher certificate> v<private key generated while requesting CA for issuing certificate> -n <title of applet> -i <applet provider> -t<timestamp provider> <appletfile.cab> signcode j javasign.dll jp Low -spc xyz.spc v xyz.pvk n Documentum Content Transfer 5.3 SP i t applets.cab 2. Verify the signature on each applet cabinet file by running the following command or performing the specified steps in Windows Explorer (see below): chktrust /q/v <appletfile.cab> 5

6 In Windows Explorer: a. Open Windows Explorer. b. Locate the file you signed. c. Right-click the file and select Properties. The Properties dialog box appears. d. Click the Digital Signatures tab to view the details of the signature. Signing WDK and Webtop applet files If are working on WDK/Webtop 5.3.x, you must sign the following files using the procedures described in the preceding sections: WDK Applications content transfer files <virtual_root>/wdk/contentxfer/contentxfer.jar <virtual_root>/wdk/contentxfer/fullcontentxfer.jar <virtual_root>/wdk/contentxfer/contentxfer.cab <virtual_root>/wdk/contentxfer/fullcontentxfer.cab <virtual_root>/wdk/contentxfer/mac_contentxfer.jar <virtual_root>/wdk/contentxfer/mac_contentxfer_osx.jar <virtual_root>/wdk/contentxfer/mac_fullcontentxfer.jar <virtual_root>/wdk/contentxfer/mac_fullcontentxfer_osx.jar WDK Applications UCF invoker files <virtual_root>/wdk/system/ucfinit.cab <virtual_root>/wdk/system/ucfinit.jar WDK Applications file selector files <virtual_root>/wdk/fileselector/fileselector.jar <virtual_root>/wdk/fileselector/fileselector1_1.jar <virtual_root>/wdk/fileselector/fileselector.cab WDK Applications web workflow files <virtual_root>/wdk/webwfm/webwfde.jar <virtual_root>/wdk/webwfm/clientjvmdetect.cab <virtual_root>/wdk/webwfm/clientjvmdetect.jar If are working on WDK/Webtop 6.x, you must sign the following files using the procedures described in the preceding sections: WDK Applications UCF invoker files <virtual_root>/wdk/system/ucfinit.cab <virtual_root>/wdk/system/ucfinit.jar WDK Applications file selector files <virtual_root>/wdk/fileselector/fileselector.jar <virtual_root>/wdk/fileselector/fileselector1_1.jar 6

7 <virtual_root>/wdk/fileselector/fileselector.cab WDK Applications web workflow files <virtual_root>/wdk/webwfm/webwfde.jar <virtual_root>/wdk/webwfm/clientjvmdetect.cab <virtual_root>/wdk/webwfm/clientjvmdetect.jar Conclusion When certificates for Java applets expire, you must re-sign the applets. While you can use the EMC certificate, you can use certificates procured from a certification authority of your choice. This paper discusses the instructions to sign applets using a certification authority other than the EMC certificate. References Please consult the following to get more information: 7