Correctly signed JNLP application prevented from running in Java 7

Question

I have a JNLP application that needs to be updated due to a certificate expiry. I have a new certificate verified by a CA. I have imported the new certificate into my keystore - I have imported the full certificate chain.

My build file signs and timestamps the jars in my build

    <signjar alias="myAlias"
            keystore="myKeystore"
            storepass="storepass"
            keypass="keypass"
            lazy="false"
            tsaurl="http://timestamp.globalsign.com/scripts/timestamp.dll">
        <path>
            <fileset dir="${app.dist.dir}" includes="**/*.jar" />
        </path>
    </signjar>

After compilation I can verify the jar files using jarsigner. Everything checks out OK, "jar verified" with no warnings.

Compiling using Java 6 and running the application using something like this

"C:\Program Files\Java\jdk1.6.0_38\bin\javaws.exe" -verbose start.jnlp

works fine. Popup tells me the application is properly certificated. I can view the certificate and it all looks good.

Compiling using Java 7 and running the application using something like this

"C:\Program Files\Java\jdk1.7.0_51\bin\javaws.exe" -verbose start.jnlp

fails. "Java security settings have prevented this application from running. You may change this behavior in the Java Control Panel"

I have tried moving the security settings down to Medium but this does not work and would not be a viable solution for me as this application is available on the internet.

I have tried compiling in Java 6 and running in Java 7 with the same results.

I am getting no error messages. I have been going at this for hours now and after removing many problems and warnings along the way I am now completely stuck. I've attached the JNLP file it that helps!

<?xml version="1.0" encoding="UTF-8"?> 
<jnlp spec="6.0" codebase="http://localgocommunicate1.x.accessacloud.com:8080/a/theaccessgroup.com" href="http://localgocommunicate1.x.accessacloud.com:8080/a/theaccessgroup.com/client/desktop/start.jnlp">
    <information>
        <title>My App</title>
        <vendor>Company Ltd</vendor>
        <homepage href="http://www.myApp.com"/>
        <description>My App</description>
        <description kind="short">My App</description>      
        <icon href="http://localhost:8080/desktopclient/images/icon.gif"/>
        <icon kind="splash" href="http://localhost:8080/desktopclient/images/splash.gif"/>
        <offline-allowed/>
        <shortcut online="true">
            <menu submenu="Startup"/>
            <menu submenu="My App"/>
        </shortcut>
    </information>
    <security>
        <all-permissions/>
    </security>
    <update check="timeout" policy="always"/>
    <!-- Global Resource -->
    <resources>
        <j2se version="1.7*" java-vm-args="-Xmx32m" max-heap-size="32m" href="http://java.sun.com/products/autodl/j2se"/>
        <!-- App Common Resources -->
        <jar href="http://localhost:8080/desktopclient/6/myappclient.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/myappshared.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/myappclient.resources.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/myapplibrary.jar" download="eager"/>
        <!-- Common Resrouces -->
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-logging-1.1.3.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/log4j-1.2.17.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-beanutils-1.9.1.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-codec-1.9.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-collections-3.2.1.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-digester-2.1.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-fileupload-1.3.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-httpclient-3.1.jar" download="eager"/>
        <jar href="http://localhost:8080/desktopclient/6/lib/commons-io-2.4.jar" download="eager"/>
        <!-- JNA -->    
        <jar href="http://localhost:8080/desktopclient/6/lib/jna-4.0.0.jar"/>
    </resources>
    <!-- OS Specific Resources -->
    <resources os="Windows" arch="x86" href="http://java.sun.com/products/autodl/j2se">
        <jar href="http://localhost:8080/desktopclient/6/swt/swt-ws-win32-win32-x86.jar" />
    </resources>
    <resources os="Windows" arch="x86_64" href="http://java.sun.com/products/autodl/j2se">
        <jar href="http://localhost:8080/desktopclient/6/swt/swt-ws-win32-win32-x86_64.jar" />
    </resources>
    <resources os="Windows" arch="amd64" href="http://java.sun.com/products/autodl/j2se">
        <jar href="http://localhost:8080/desktopclient/6/swt/swt-ws-win32-win32-x86_64.jar" />
    </resources>
    <resources os="Mac OS X" arch="x86_64" href="http://java.sun.com/products/autodl/j2se">
        <j2se version="1.6+" java-vm-args="-XstartOnFirstThread"/>
        <jar href="http://localhost:8080/desktopclient/6/swt/swt-ws-cocoa-macosx-x86_64.jar" />
    </resources>
    <application-desc main-class="myappclient.Client">
        <argument>-version</argument>
        <argument>6</argument>
    </application-desc>
</jnlp>

Any help greatly appreciated

Answer 1

OK I have got a solution that works for me.

1. Make sure you compile using the latest version of the JDK, in this case 1.7.0_51-b13

2. Update the JNLP file to enforce Java 1.7

   <resources>
   <j2se version="1.7*" java-vm-args="-Xmx32m" max-heap-size="32m" href="http://java.sun.com/products/autodl/j2se"/>