I'm completely missing what you are talking about it. While technically speaking, an applet can run "inside" a servlet, when you do such, you are treating it as a component/class, not an applet. There is no GUI. It isn't running inside the browser. And hence is not an applet, even if it subclasses Applet. Servlets don't require certs since they run inside the server.