Comodo vs StartSSL: will the code signing authority affect ability of Java applets to run without security warnings?

Question

We reviewed other posts on SO about code signing authorities, but none address our core concern: will using one code signing authority vs another affect the ability of an applet to run without security warnings? Right now, our applet prompts warnings about unsigned code, and we would like to avoid these warnings when the applet runs.

Price and other factors aside, will our Java applet work equally as well in all browsers regardless of which code signing authority we pick?

Answer 1

our applet prompts warnings about unsigned code, and we would like to avoid these warnings when the applet runs.

It's important to understand that those warnings are because the code is unsigned. If it is signed, the text of the warnings will change.

Price and other factors aside, will our Java applet work equally as well in all browsers regardless of which code signing authority we pick?

It depends on whether the Certification Authority has the status of already being in the Java 'trusted certificates key-store'. My understanding is that Thawte and & Verisign (two of the more expensive ones) are, while some of the cheaper newer entrants into the field aren't.

For the latter group, the user will first be prompted to accept/import their certificate, before being prompted to accept your code. For the more expensive ones, the user will only see one prompt for your signed code.

But the thing you need to be aware of is..

..affect the ability of an applet to run without security warnings?

No avenue will suppress all security warnings. Those warnings are there for:

1. The protection of the end user.
2. Maintaining Java's reputation as a 'secure' plug-in. So that people are willing to have the Java plug-in installed at all.