a quick workaround to fix the unsigned JNLP issue after Java upgraded to version 8 update 131

While I successfully opened a JNLP file with Java to get the console access to a remote server this afternoon,  Java prompted me there was a upgrade. As usual, I didn’t pay much attention to what the upgrade is and I just clicked the “Upgrade now”.  When the upgrade was completed, I tried to reopen that JNLP file again then I kept getting the same error message:

“Unsigned application requesting unrestricted access to system.  The following resource is signed with a weak signature algorithm MD5withRSA and is treated as unsigned: … …”

After did some search on google, the root cause was, in the version 8 update 131, JAR files signed with MD5 algorithms are treated as unsigned JARs, as explained here.

I cannot wait the vendor to update the JNLP file (dunno know when they will update it), and I don’t like to downgrade to the older Java either.

So, after some digging, I just found a quick (but temporary) solution:

Just comment out the setting of “jdk.jar.disabledAlgorithms” in the file of”lib/security/java.security” (which is located at “/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/java.security, on my MacOS 10.12)

# jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024

After that, the JNLP file will be running as usual again.

27 thoughts on “a quick workaround to fix the unsigned JNLP issue after Java upgraded to version 8 update 131

  1. Great thanks, the path on windows is something like C:\Program Files (x86)\Java\jre1.8.0_151\lib\security

  2. so im trying to figure this out on my own …Do i need to install a java developers package to access this? i cant figure it out from the terminal how to get to that path to add the #

  3. To disable the window for
    The following resource is signed with a weak signature algorithm MD5withRSA and is treated as unsigned: http:XXXX:8888/forms/java/frmall.jar

    Solution:
    1) go to C:\Program Files\Java\jre1.8.0_151\lib\security\java.security
    2) change the permission to edit and save.
    3) Open the file in MS-word,go to Line no 613, Remove “MD5” from that line.
    4) Save the file and close. Re-run the Form…

  4. Zhaojun thank you! I edited the file in note pad, saved. tried again and BOOM! I’m in.

  5. Zhaojun had it 90% correct. If you have the MD5withRSA error, here’s the guaranteed quick fix I found:

    1. Click Start button, type Notepad.
    2. Right-click the notepad icon > click Run as administrator.
    3. On Notepad, File > click Open.
    4. Find the ‘java.security’ file (On my PC, it was at C:\Program Files (x86)\Java\jre1.8.0_161\lib\security), select ‘All Files’ from the drop-down box at the bottom right of the window, select java.security and open it.
    5. In the java.security file, ctrl+f and find these:
    (i) ‘jdk.certpath.disabledAlgorithms’ : remove ‘MD5’ from the sentence.
    (ii) ‘jdk.tls.disabledAlgorithms’ : remove ‘MD5withRSA’ from the sentence.
    6. Save & Exit.
    7. Try opening your blocked content again & BOOM you’re in~

    P/S: I haven’t experienced other java errors other than this, but I assumed if you stumbled upon other algorithm error codes, just simply remove the wording from the java.security file and you’re good to go. (e.g. MD2 error: just remove any ‘MD2’ wording you come across in the java.security file).

    Hope this helps.

  6. The method involves acquisition of data referring to the physical traits of earth significantly the relative place of factors and the magnitude
    of areas https://math-problem-solver.com/ . Actually,
    the probability that the opposite door veils the automotive is 2/3, so you should change.

  7. As of 8u181, I needed to remove MD5 from jdk.jar.disabledAlgorithms. This add to the other two already mentionned.

  8. For Systems Updated To 1.8.0_181: Comment out these 3 sections from java.security (location of file varies, see other replies) by putting a # character just before these references:

    jdk.certpath.disabledAlgorithms
    jdk.jar.disabledAlgorithms
    jdk.tls.disabledAlgorithms

    Important Note: Some of these sections have multiple lines so be sure to comment out all of the lines for each of these. And as always, make a backup beforehand just in case.

  9. Updated To 1.8.0_202: Comment out these 3 sections from java.security .But issue seems not resolved.Can anyone help?..anything more to do?

    jdk.certpath.disabledAlgorithms
    jdk.jar.disabledAlgorithms
    jdk.tls.disabledAlgorithms

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s