Is this code signing certificate valid for signing applets?

Question

We purchased a code signing certificate for signing applets, but we get the following error when signing an applet.

    C:\CM\WEB-INF>jarsigner -keystore code_signing.keystore C:\CM\SweetApplet.jar code_signing_real
Enter Passphrase for keystore:
    jarsigner: Certificate chain not found for: code_signing_real.  code_signing_real must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

Is our certificate not correct? Here's the certificate in question below. The error message seems to suggest the certificate must contain a private key, but we don't understand how this can be since the private key is never supposed to get exposed to anyone but us.

C:\CM\WEB-INF>keytool -list -keystore code_signing.keystore -alias code_signing_real -v
Enter keystore password:
Alias name: code_signing_real
Creation date: Mar 13, 2014
Entry type: trustedCertEntry

Owner: CN=CE, OU=CE, O=CE, L=PAL
O ALTO, ST=California, C=US
Issuer: CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US
Serial number: 728b78e4ded46af26494c59690e428f0
Valid from: Wed Mar 12 17:00:00 PDT 2014 until: Fri Mar 11 15:59:59 PST 2016
Certificate fingerprints:
         MD5:  E0:DB:9E:DC:37:1E:C2:A9:EA:C0:A8:21:22:61:9F:DD
         SHA1: F9:C3:75:37:CA:86:4D:E2:11:BE:52:79:CE:FA:B3:6B:32:F0:CF:D2
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:

#1: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

#2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [accessMethod: 1.3.6.1.5.5.7.48.1
   accessLocation: URIName: http://ocsp.thawte.com]
]

#3: ObjectId: 2.5.29.4 Criticality=false

#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://cs-g2-crl.thawte.com/ThawteCSG2.crl]
]]

#5: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  codeSigning
  1.3.6.1.4.1.311.2.1.22
]

#6: ObjectId: 2.16.840.1.113730.1.1 Criticality=false
NetscapeCertType [
   Object Signing
]

Answer 1

It doesn't say the certificate must contain a private key. Certificates don't contain private keys. Read it again. It says the key entry must contain a private key and a certificate.

So however you constructed this KeyStore, it is invalid. Probably you just imported the signed certificate into a new KeyStore, or with a new alias. You must import it into the original KeyStore where the private key is, with the same alias as the private key.

You must also import the certificate chain, as trusted CA certificates, with another alias.