Dynamic Trust Management

New dynamic trust management facilities in J2SE 1.3.0 provide pop-up dialogs to let users validate applet signers, eliminating the need to deploy security key files to each client that runs the signed applet.

Previously, if a user wanted to give an applet from a trusted source extra security permissions to allow the applet to perform normally forbidden operations, the user needed to preconfigure his or her local cache of trusted signer certificates to recognize the certificate of the applet's trusted source. This would need to be done for every client machine on which the applet might potentially be run.

J2SE 1.3.0 provides a better solution by providing facilities to extract the applet's signers from the applet's codesource and pass them to the browser. The browser then verifies the certificate chain all the way up to its root certificate, and checks if that root certificate is contained in the browser's database of trusted root certificates. If so, the browser displays the chain of the authenticated signer and give the user the option to remove all security restrictions on the applet.