Yes. Plus you have to sign the application and all the used librarys, because native parts are downloaded to the client that can't be executed in an untrusted environment. Make also sure, that everything ends with ".jar". ".zip" is supported by 1.5, but the beta of Java6 fails on it.
You also have to make sure that your webserver is capable of sending the correct contenttype for jnlp-files. If it isn't, you can put the jnlp-content in a php- or jsp-script and let that set the contenttype. Or, if the server supports it, use a .htaccess file that defines the correct type-mapping like so (that's what i'm doing): AddType application/x-java-jnlp-file jnlp