Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to open a Java Web Start applet on OS X Lion but it won't open due to certificate validation (of the Java code, not the source website of the JNLP Web Start file). This JNLP opens fine on OS X Snow Leopard.

The error I receive is: Failed to validate certificate. The application will not be executed.

error received

And clicking 'Details' gives me: Unable to evaluate certificates.

error details

What is puzzling me is that I can't work out which bit of OS X has changed so as to not trust the certificate any more. The code is signed by a VeriSign 'Class 3 Code Signing 2010 CA' which is included in the signed Java JARs, and all of the relevant intermediate and root CAs seem to be in my OS X system's cacerts (and they're the same certs in both Lion and Snow Leopard cacerts).

Also, I downloaded all of the JARs that were listed in the Web Start JNLP manually and ran them through 'jarsigner -verify' and they all verified correctly!

So - any suggestions where Java Web Start on OS X is looking to determine whether this code is valid, and what might have changed in the upgrade to OS X Lion?

share|improve this question
I wonder if the code somehow fails on a specific certificate. (Like a long time ago, I ran into vague issues with Thawte certificates that had a @ character in their name.) Trying a totally unsafe self-signed example from gets me this warning. I've not accepted it, but do you get the same dialog as I do for that example? – Arjan Nov 12 '11 at 12:44
And as usual: what does trying with the Guest account give you? – Arjan Nov 12 '11 at 12:47
Trying that file, I get the same "this is untrusted; would you like to allow / deny this self-signed code?" (paraphrased) dialog popping up. I do not get that chance to accept the untrusted code from this real application. As for the Guest account - are you suggesting trying the Guest account on OS X as it has some different behaviour than my regular account? – dec Nov 15 '11 at 11:31
The Guest account won't have anything in its Keychain. In the small chance that you're not getting the issue using that account, you would then know that your own Keychain is faulty. (Or something in the Keychain makes the Java code fail.) Small chance, but easily checked! – Arjan Nov 15 '11 at 17:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.