java plugin cache and dynamic IP host

I'm trying to use Amazon S3 and Amazon Cloudfront CDN to deliver the jar files of my applet application.

I'm seeing several cache misses of my jars by the java plugin. This is a show-stopper for me, as the size of my applicatio开发者_运维技巧n is around 3Mb, and I can't make my customers re-download the application every time.

The problem is that, due to a "security vulnerability issue" the java plugin cache is resolving the IP address of the jar remote host, but Amazon S3 uses a dynamic IP. I guess the same problem would happen with Akamai or any other decent CDN service.

Is there anything I can do?

---

Well the address has to be resolved at some point, that’s not exactly the problem.

The problem is that the applet wants to make sure the .jars come from the same source as the page holding the applet to make sure nobody is returning malicious jars instead of the originals. But when the sockets are opened using the URL it is resolving to a different address, yes, because you are using a cloud not a single server.

Im sure you can solve it by signing the .jars. That way the applet knows they are originals, no matter the source.

What I do is that I create a certificate manually. Like thie:

keytool  -genkey -keyalg rsa -keysize 1024 -alias {put a name for the cert here} -validity 3650 -keystore {.. and a file name here.}

Note this will prompt for you to set a user and password for the certificate.

Then sign ALL your jars like this ->

$1/jarsigner  -keystore { the above file name} -storepass password  -keypass password     whatEver.jar         {cert name, from above.}

The only issue I have seen with this method is that since the cert is not signed by a recognized authority in the browser, it will promopt the first time to add it to the trusted certs. Normally not an issue.

Other wise you can:

1) Get a certificate from a recognized authority in the browser (Thwate, Verisign ) ( There are some that will do it for free)

2) Set up an authority and ask your users to add it into the browser's recognized authorities.

Hope this helps!

-Alex