The authors assume no responsibility or liability for any errors or omissions in the content of this documentation. The information contained in this documentation is provided on an "as is" basis with no guarantees of completeness, accuracy, usefulness, timeliness or of the results obtained from the use of this information.

These FAQs refer to the OpenWebStart version 1.11.0-SNAPSHOT and were build at 12.06.2024.


What is OpenWebStart?

OpenWebStart is an open source reimplementation of the Java Web Start technology. It provides the most commonly used features of Java Web Start and the JNLP standard, so that your customers can continue using applications based on Java Web Start and JNLP without any change. OpenWebStart is based on Iced-Tea-Web and the JNLP-specification defined in JSR-56.

Under which license does OpenWebStart come?

OpenWebStart is released under the GPL with Classpath Exception.


Do I have to install a Java on my system to run OWS?

There is no need to have any JVM installed on your system to run OWS. OWS bundles its own JVM. OWS has a JVM Manager which can find local JREs or download JREs (from the Internet) to run your Jnlp application..

Don’t worry if no JVMs are shown in JVM Manager after installation of OWS. If you wish you can use Find local or Add local…​ to detect and add an existing Java instance on your client device to the JVM Manager or simply start the JNLP file and the JVM Manager will download an appropriate JRE for your application.

The downloaded JREs are stored in %userhome%/.cache/icedtea-web/

I saw there is a bundled JRE installed together with OWS, can I use it?

There is a bundled JRE installed together with OpenWebStart (OWS). This JRE is used solely to run OWS. Only the JVMs managed by the JVM Manager can be used to run JNLP applications.

This is a precautionary measure as we regularly update this bundled JRE, and we do not want to break any working application.

Which Java versions can be used to run my JNLP applications?

Your JNLP applications can be run with a version of Java such as 8, 11, 17, or 21. We have not run any tests with higher versions of Java yet but from the experience collected while adding support for Java 11 we do not expect any big obstacles.

OpenWebStart JVM Manager will download and manage JVMs as they are requested by an application. Currently, we provide access to long-term support (LTS) versions of JDKs from various vendors by our default download server. Have a look at the OWS user guide for a list of all JDK vendors that currently are available on this server. Note that this list might be subject of change in the future.

If your preferred JVM is not provided by the default download server, you can either add locally installed JVMs to your JVM manager’s list or setup a custom download server.

Is there an MSI installer for OpenWebStart?

Currently, we do not provide an MSI installer. More details on the reasons can be found at

Can I install Oracle Java Web Start and OpenWebStart in parallel?

This is possible but might lead to potential conflicts you have to take into consideration. When JWS is installed, the .jnlp MIME type might be associated already, so that OWS could not associated when installed at a later point in time. In this case the .jnlp mime type is reserved by JWS and OWS offers you the possibility to use .jnlpx as an alternative to associate your applications directly with OWS.

Please be aware that .jnlpx files in some browsers, such as Chrome, opens as text instead of getting saved after download. The reason is that Content-Type returned by server is text/Plain. You can solve this by configuring the Web server so that all files with the .jnlpx file extension are set to a application/x-java-jnlpx-file MIME type.

It is possible to specify separate System Configuration for JWS and OWS. Please see the section OWS specific System Configuration in the OWS Guide.

Debugging and Error Reporting

Does OWS write log files and where do I find them?

The log files of OWS are located in a hidden directory below your user home directory:


where <user-home> depends on your operating system. By default this should be

<root>\Users\<your-username>    (Windows 10)
/Users/<your-username>          (MacOS)
/home/<your-username>/          (Linux)

Note that logging has to be activated using the OWS Settings application by checking "Activate debug logging" and "Log to file" on the "Logging" tab.

The .config folder in the user home can be hidden in file explorers in your operation system. Information how to view hidden folder and files can be found at this external link.


How to set up the resource server to facilitate caching by OWS

To find out whether a resource has been modified since the last download, OWS sends a HTTP HEAD request to the server and expects to receive the last modified timestamp of the resource on the server. In order to facilitate caching of resources by OWS it is necessary that the server from where the resources are downloaded is configured to respond to HTTP HEAD request. In case the server is not configured to respond to HTTP HEAD request, OWS will not be able to determine the last modified timestamp of the resource and will go ahead and download the resource.


What to do when my JNLP application complains about missing certificates in the trust store?

Sometimes OpenWebStart signals that the application’s digital signature cannot be verified when launching an applications with signed jars.

OpenWebStart does not maintain a curated collection of certificates by itself. Rather it relies on the JVM which brings a default set of certificates.

In this context it is helpful to distinguish between the bundled JVM, used to run OpenWebStart itself, and the custom-selected JVM used to launch the JNLP applications. While the bundled JVM cannot customized or replaced by an OpenWebStart user, the JVM used to run the JNLP application is determined by the definition in the JNLP file and by the configuration of the OpenWebStart JVM Manager.

With its half-yearly releases (spring and fall) we update the bundled JVM. This has an impact on the certificates included in the internal JVM.

The certificates available during the execution of the JNLP application are those who come with the custom-selected JVM.

How can I add certifictes to the trust store?

It is possible to add certificates to a per-user trust store. OpenWebStart supports importing of PKCS12 certificates. Open the settings and go the tab Certificates then select the appropriate user store and hit "import…​" Most likely you will want to import a certificate to the Trusted Certificates or the Trusted Root CA Certificates.

OWS import certificate
Figure 1. Import Certificate

Another possibility is to select the option Always trust content from this publisher

OWS trust publisher
Figure 2. Always trust this publisher


Does OpenWebStart support Applets?

Applets are not supported and there are no plans to support them in the future. We also do not consider this as a deviation from the JNLP-standard as this is an optional feature according to the JSR-56 specs.

How to start a Jnlp application in Offline mode with OpenWebStart?

The Offline mode means that OWS will not access a server to fetch resources specified in the Jnlp file.

You can start a previously cached Jnlp application in Offline mode using the following command:

javaws -Xoffline myapp.jnlp

In the above example myapp.jnlp is a previously downloaded and cached Jnlp file. OWS expects that the jars files for the app are available in the cache. For example:

<User Home>/.cache/icedtea-web/cache/0/0/myapp.jar

Note that you will get if you run javaws without the -Xoffline parameter when NOT connected to the server as OWS will try to fetch the resources from the server and fail.

How to pass arguments to the application started by Jnlp

javaws -arg arg1=value1 arg2=value2 -jnlp <path to jnlp file>

The specified arguments will be passed to the application’s main method.

How can I define a server whitelist for OWS?

This field is currently not editable in the UI. Edit the deployment properties file ${userHome}/.config/icedtea-web/ file with a text editor by adding a new line:,,

The different servers are listed as a comma separated string. Localhost is implicitly always in the white list. If you delete the line again then no whitelisting is applied and all servers are reachable.

Note that whitelisting only applies while downloading resources (jars and jnlps) and not while an application is running. Thus, an application can open a connection to a server which is not in the white list.

It is also possible to specify the content of the whitelist when installing OWS (unattended installation), See and for further details.

It is possible to specify a wildcard in the host and port part of the URL. Some examples are shown below. Please see the Guide to OpenWebStart for details.

Whitelist entry UI Displayed Comment



any domain which ends in "" is whitelisted



any domain which ends in "" and any port is whitelisted

How can I define a JVM Server Whitelist?

When allowing JVM server download from the JNLP file using the property ows.jvm.manager.server.allowFromJnlp=true, as a security measure it is advisable to define a whitelist for JVM server URLs that will be specified in JNLP files. JVMs will be allowed to be downloaded from only those server URLs that match a whitelist entry.

The JVM server whitelist can be defined in the deployment properties file ${userHome}/.config/icedtea-web/, *

How to run OpenJFX based JavaFX applications with OpenWebStart?

With JDK 8

To be able to run a JavaFX application with OWS using Java 8 requires an installation of Java 8 JVM that includes JavaFX. Some of the vendors that have JavaFX as part of their Java 8 JVMs are Oracle, Azul, BellSoft and Amazon. OpenJDK 8 from Adopt does not include JavaFX.

Using the JVM Server feature of OWS JVM Manager it can be ensured that a suitable JDK 8 with JavaFX will be installed on the machine for OWS to start a JavaFX app. The required JVM from a preferred vendor can be specified in the Jnlp file:

<?xml version="1.0" encoding="utf-8"?>
<jnlp spec="1.0+" codebase="">
    <title>JavaFX 8 App</title>
    <vendor>Karakun AG</vendor>
    <java version="1.8*" vendor="zulu" href=""/>
    <jar href="generated-jars/javafx-test.jar"/>
<application-desc main-class="com.karakun.ows.javafx_test.HelloWorld"/>

In the above Jnlp file, the <java> tag specifies the name of the JVM vendor and URL of the JVM server which hosts a JSON that points to the appropriate JVM with JavaFX. For example:

     "vendor":"Zulu Community Edition",

When the above Jnlp file is started with OWS, OWS will install the specified JVM with JavaFX for running the JavaFX application.

With JDK 11 or higher+

Create a JavaFX project which should have OpenJFX libraries on its path for compilation. Required OpenJFX version can be obtained from: OpenJFX Download.

In order to deploy a JavaFX application using OWS:

  1. package the JavaFX application in a jar

  2. gather platform (OS) specific jars from the OpenJFX libraries. It is recommended that you use openjfx-17.x. It works with Java 11.

  3. all jars must be signed and must have required security attributes in their manifests.

  4. deploy all jars on a server

  5. create a Jnlp file. For example, the following sample jnlp file is meant to run on Windows. However, one can also specify OS specific jars under OS specific <resources>

<?xml version="1.0" encoding="utf-8"?>
<jnlp spec="1.0+" codebase="">
    <title>JavaFX 11 App</title>
    <vendor>Karakun AG</vendor>
    <java version="11*"/>
    <jar href="jars/jfxapp.jar"/>
    <jar href="jars/javafx-controls-"/>
    <jar href="jars/javafx-graphics-"/>
    <jar href="jars/javafx-base-"/>
    <jar href="jars/javafx-fxml-"/>
<application-desc main-class="com.karakun.ows.javafx_test.FXAppLauncher"/>

Note: When running with Java 11 or higher the JavaFX Application is required to be launched via a launcher class:

// Launcher for JavaFX application which is specified in the Jnlp file
public class FXAppLauncher {
    public static void main(String[] args) {

// JavaFX Application
public class FXApp extends Application {
    public static void main(String[] args) {

	public void start(Stage primaryStage) {
        ... // JavaFX code

Is there a way to advice OpenWebstart to use a 32-bit JVM on a 64-bit machine?

It is possible to set the require-32bit attribute in the JNLP file as follows:

  spec="1.0+" codebase="...">
    <java version="1.8*" require-32bit="true" ... />
    <jar href="MyDemo.jar"/>
  <application-desc main-class="misc.MyDemo"/>

Subscription and Premium Support

Is there a subscription for OpenWebStart?

Basic subscription provided by Karakun is the cost-effective way to support OpenWebStart. With this option you may report bugs using a dedicated communication channel (support forum) and your bug reports will have a higher priority. If you wish, we will add your company logo to our sponsor page for free. Plus, you’ll get a 10% discount for development of individual features.

Is there a premium support for OpenWebStart?

With premium support provided by Karakun you may report bugs or issues using the premium communication channel (via support forum). Your bug reports will have the highest priority. Karakun will guarantee service levels depending on the severity of the bug (during business hours). After a bug is fixed, a corresponding release will be provided. Plus, you’ll get a 25% discount for the development of individual features. Upon your wish, your company logo will be listed as a premium sponsor on our website.

What are the costs for subscription and premium support?

Please contact to figure out which support model fits your needs best.