When trying to install some signed applications like Opera Mini on the ZN5
I get "root certificate missing", and the application fails to install.
This message refers a certificate that is used to confirm that the application
is from a legitimate author. Based on confirmation of a legimate author, the
signed application then has the possibility of being allowed to some more
security-sensitive operations, such as reading and reading files that the
application did not correct.
For background on this issue, I recommend this post on Midlet signing on the Javia blog, and the post How MIDlet Signing is Killing J2ME.
The related "Java Root Certificates" involved on the ZN5 are accessible to view
at Settings: Security: Certificates: Java Root Certificates There I found
that Motorola had added the certificate named "GeoTrust CA for UTI". I believe
this is the same as the "Java Certified" certificate referenced above.
Opera Mini fails to install because it signed with certificates from Thawte and
Verisign but not GeoTrust. As the posts above explain, the "Java Verified /
GeoTrust" certificate could cost Opera something like $30,000 per bug fix to
use that certificate, so it's no wonder that they haven't used it.
Unfortunately, Motorola has not provided the Thawte or VeriSign certificates on
the ZN5, nor have they have provided a way for users to add their own
additional root certificates. (It appears that the needed certificates are
easily available for free).
In the case of Opera Mini, I already trust the downloads from opera.com, so I'm
not so concerned about the legitimate author feature of the signed java
midlets. I'm interested in the extra permissions that a signed application
could take advantage of.
I recommend that Motorola release an update to the phones software that
adds additional root certificates and/or allows users to add their own.
In the meantime, there is a theoritical way in which a ZN5 owner can start
with an unsigned Java application, and then manually grant it the permissions
usually reserved only for signed applications. For Opera Mini, I believe this would enable the "Save Page" feature as well as possibly enabling file upload fields.
As I understand, the permissions are stored in simple text files on the phone.
By gaining access to the phone by telnet or FTP, these files can modified and
the permissions changed. If you Google for how to unlock java apps on the ZN5,
I'm sure you can find at least one way to do this yourself using a series of
hacks, which are reported to work on T-mobile's ZN5 software as well as an
unbranded ZN5.
I have not attempted that process yet myself. I would prefer a cleaner
solution, such as one Motorola or T-mobile could provide.
Both Motorola and T-mobile are hurting because the popularity of the iPhone.
Part of the iPhone's success is the App Store, which seems to avoid this mess of certificate problems that Java applications for mobile phones have. For its part, Motorola could
make some simple changes to increase the value of their phone by including more
root certificates or letting people add their own.
T-Mobile has apparently further reduced the utility and value of this phone by
crippling network access for many Java applications. Perhaps T-mobile has
concerns about users racking up accidental data charges. With the explicit
prompting that applications provide when accessing the network, I think this
would be hard to do. Giving Java applications full access to wifi doesn't
concern T-mobiles network and further help the ZN5 compete with the iPhone.
At least, T-Mobile could more clear in their marketing of the ZN5 that they
have added significant restrictions to the device.
I hope these notes help to give some people leads after they run into the "root certificate missing" problem on the Motorola ZN5.
You may also be interested in my general review notes or my ZN5 bookmarks.
![](/mt/mt-static/support/assets_c/userpics/userpic-1-100x100.png")
Very helpful and very clearly written. Now I won't waste my time with the opera mini. Thanks!
Abbott,
I could have been clearer: There is an unsigned version of Opera Mini that they provide and it's quite nice-- it's my preferred browser. It just lacks the ability upload files through the file upload field, and it can't download files either, although it usefully passes off download links to the built-in browser when it finds them.
My troubles above were with the *signed* version of Opera Mini, as well as other signed Java applications.
i have an unsigned version of opera mini on my phone (a zn5 of course, t-mobile branded), and it does not work at ALL.
i've looked all over, and everything i've tried hasn't worked. i love opera mini and my zn5, i wish they'd work together! =/
here's to hoping motorola or t-mobile releases an update for the zn5 to fix some of these problems.
ok so like a month ago i got the ZN5 from T-mobile. I want opera mini to work, so i followed the link about the certificates that says "easily available", and put them on my computer... Can anyone give me detailed instructions on what to do next?
Dave, as it says in the sentence before "easily available", neither Motorola nor T-Mobile have provided a way for you to add your own root certificates, regardless of whether or not they are easily available. There is no answer hiding here.
yeah i finally figured it out.... i used some other programs to install opera and ebuddy