12.6. Creating Signed Remote Applications

Security in Mozilla's web browser is designed to meet today's advanced scripting needs in a secure manner. Mozilla is a much more secure browser than past Netscape 4.x and Internet Explorer releases because it has a better sense of what remote scripts can and cannot do.

Because of Mozilla's approach toward potentially insecure applications, if you decide to serve up your own application remotely, remember that you will not have automatic access to the chrome in the way you do when you have a registered, locally installed Mozilla application. Unless you sign your application or have the user turn on a special preference (see Section 12.3), services like XPConnect will not be available.

In Mozilla, you can bundle any number of files into a JAR archive (which, you'll recall from Chapter 6, is just a zip file with a JAR suffix) and designate the archive as an object that can be signed. This designation makes it very easy to produce an entire signed and secure remote Mozilla application because it stores your application in a single file type that Mozilla already treats as a separate package.

This section provides an overview of the signed script technology and shows you how to create signed applications that live on the server but take full advantage of the user's local chrome, including Mozilla components.

12.6.1. certs.mozdev.org CA Certificate

Before users can load signed applications, a CA certificate must be installed into their installed copy of Mozilla. Once this certificate is installed in a browser, all MozDev-signed applications can work with this certificate. This setup makes things easier on users who access many of these signed applications because they do not have to install a new certificate for each one. Also, if the user wants to use applications from other certificate authorities, they need to install a distribution certificate from that certificate authority.

Installing the certificate is easy. Just provide the users with a regular link on a web page -- for example, http://certs.mozdev.org/certs_mozdev.cacert. When loading this page, a dialog box pops up and asks the user to install the certificate. See the Section section later in this chapter for more information about this process.

12.6.2. Signing Certificates

As a Mozilla application developer, you can obtain a common MozDev signing certificate and release a signed application that puts your application on par with other signed MozDev applications. If you consider your application mission-critical, however, you should go to a trusted CA such as Verisign. Mozilla already supports the VeriSign Netscape Object Signing CA, and discriminating users may find it more acceptable. A few other CAs listed in Mozilla's Certificate Manager may support Netscape Object Signing, so researching these options further may be worthwhile.

To get a certs.mozdev.org/signing certificate, send email to cert-request@mozdev.org. In return, you will receive a .cacert file that will be used to sign your remote Mozilla application.

SignTool (part of the NSS tool sets) takes a directory of files, zips them up into a JAR archive (refer to the section Section later in this chapter to see how to do this), and signs the archive using the certificate you specify.

Use CertUtil to set up a database for SignTool. Next, run some commands to set up the certificate environment:

C:\NSS\bin>certutil -N -d .
C:\NSS\bin>certutil -A -n "certs.mozdev.org/signing" -t ",,C" 
-i eric.cacert -d .

The first command creates an empty cert7.db file where certificates can be stored. The second imports your Signing Certificate into the database. SignTool can use only certificates that reside in a database, which is the reason for this process.

12.6.3. Creating and Signing the Application

When someone obtains a private key (which is part of a Signing Certificate), they can encrypt their scripts and produce a public key. The relationship of the private key and the public key is called a private-public key pair. Using this relationship, you can create a signed Mozilla application and make it available to users in three steps:

  1. Build the application itself, including the XUL, CSS, JavaScript, and whatever else you use to create the Mozilla application.

    For this section, let's assume that you already created the XUL and JavaScript for the application and have all the files and directories together.

  2. Archive and sign the application. SignTool takes care of both steps simultaneously, putting your application files in a JAR with a digital signature to validate everything.

    The signing process described next in Section deals entirely with SignTool.

  3. Distribute your application (see the later section Section

12.6.4. Receiving a Signed Application

As shown in Figure 12-8, when Mozilla receives a JAR, it must check it for validity before displaying the contents. A public key in certs_mozdev.cacert must be used along with the digital signature to make sure that the contents are not tampered with and that the signature is valid.


//FIXME did we loose content here?