Java – How to run jar files

To launch the FileMaker Server Admin Console, you will need to make a modification to your Java security settings. The originating web address of the Admin Console download needs to be whitelisted.

Open the Java Control Panel and navigate to the Security tab. Click the "Edit Site List" button. Add the FileMaker Server web address including the port and http: http://your-fm-server-address:16000. Ignore the warning about insecure HTTP that pops up.

You can now launch the FileMaker Server Admin Console by acknowledging the warnings at run time.

EDIT: Although the FileMaker Server internal web start page and Admin Console say there are no updates available, 12.0.5(12.0v5 is available from the FileMaker, Inc. website and claims to have a fix for the Java security issue. http://help.filemaker.com/app/answers/detail/a_id/12826/~/software-update%3A-filemaker-server-12.0v5-and-filemaker-server-12.0v5-advanced

A couple of things you'll need to do.

• Firstly, in the trust-stores for the java JVM has the certificate for the root CA in your PKI
  • both where the signed code will be executed and the box where you are doing the code-signing, which by default would be %JAVAHOME%/lib/security/cacerts
    • On Windows, this would usually be %PROGRAMFILES%\Java\jre7\lib\security\cacerts
  • Also it should be in the system trust-store for any boxes where you will execute that code
    • Windows: mmc.exe --> Certificates --> Computer Account --> Trusted Root Certification Authorities
    • RHEL: /etc/pki/tls/certs/
• Secondly, make sure your code-signing certificate is setup to sign codes
  • It should have the Extended Key Usage "Code signing" (this may be numerically represented as OID 1.3.6.1.5.5.7.3.3 being present and set to true)
  • It should have the Key Usage include Digital Signature
  • It should have the Basic constraint "CA" set to false (this might also be listed as "Subject Type=End Entity"), and "critical" set to "true"
  • It should have a CDP (CRL distribution-point) listed and that should point to a valid HTTP or LDAP URL where the CRL is available (this lets you explicitly un-trust a code that is found to be inappropriate after it was signed)