java - 如果签名 jar 的证书(带有时间戳)过期会发生什么

Question

我在 2 年前用时间戳签署了一个 jar(小程序)。证书即将到期。会发生什么？是否会向用户发出警告，它会简单地工作吗？它会停止工作吗？

我没有在小程序中添加任何特定代码来处理时间戳。我在签名时只包含了 -tsa url。

编辑:它一直在工作。

Answer 1

在 Java 5 SE 之前，签名证书已过期的签名 jar 将不再有效或不可用。

对于 Java 5 SE 和更高版本，签名证书过期的签名 jar 将继续工作。但是，过期的证书不能用于签署任何其他 jar。

From Oracle's docs :

Prior to J2SE 5.0, the signature generated by jarsigner contained no information about w hen the signature was generated. With no other information available, systems/deployers (including users of the Java Plug-in) often based their validity assessment of a signed JAR file on the validity of the signing certificate. When the signing certificate expires, systems/deployers conclude that the signature, and hence, the JAR file, has expired. Because signing certificates typically expire annually, this caused customers significant problems by forcing them to re-sign deployed JAR files annually.

Starting in J2SE 5.0, jarsigner can generate signatures that include a timestamp, thus enabling systems/deployer (including Java Plug-in) to check whether the JAR file was signed while the signing certificate was still valid. In addition, APIs were added in J2SE 5.0 to allow applications to obtain the timestamp information.