Java的签署仅在Mac OSX10.7吊销证书的小程序（狮子） [英] Java signed applet certificate revoked only on mac OSX10.7 (Lion)

问题描述

我有一个签名的小程序，它可以在Windows罚款，Mac和LT = 10.6，和Linux操作系统。然而，在OSX狮子，签名证书已被吊销。这里是从Java控制台的安全调试信息：

I have a signed applet that works fine on windows, Mac <= 10.6, and linux. However, on OSX lion, the signing certificate is revoked. Here is the security debug info from the java console:

security: Loading certificates from Deployment session certificate store
security: Loaded certificates from Deployment session certificate store
security: Loading Root CA certificates from from keychain
security: Loaded Root CA certificates from from keychain
security: Validate the certificate chain using CertPath API
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: jpicertstore.cert.getkeystore
security: No timestamping info available
security: Cannot find jurisdiction list file
security: The CRL support is enabled
security: PC Operating Center
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.thawte.com/ThawteCodeSigningCA.crl]
]]

security: Thawte Code Signing CA
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.thawte.com/ThawtePremiumServerCA.crl]
]]

security: Use CRL setting from certificate
security: The OCSP support is enabled
security: PC Operating Center
security: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: 1.3.6.1.5.5.7.48.1
   accessLocation: URIName: http://ocsp.thawte.com]
]

security: This certificate does not have AIA extension
security: Use OCSP setting from certificate
network: Cache entry not found [url: http://crl.thawte.com/ThawtePremiumServerCA.crl, version: null]
network: Connecting http://crl.thawte.com/ThawtePremiumServerCA.crl with proxy=DIRECT
network: Connecting http://crl.thawte.com:80/ with proxy=DIRECT
network: Downloading resource: http://crl.thawte.com/ThawtePremiumServerCA.crl
    Content-Length: 181,278
    Content-Encoding: null
network: Wrote URL http://crl.thawte.com/ThawtePremiumServerCA.crl to File /Users/koutbo6/Library/Caches/Java/cache/6.0/38/2fb889a6-30a08967-temp
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
network: CleanupThread used 990300 us
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
security: This certificate has been revoked
Ignored exception: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate has been revoked

请问AP preciate如何得到签名的小程序在Lion上工作的任何提示。

Would appreciate any tips on how to get the signed applet to work on Lion.

更新：

下面是对证书的序列号：28 29 A9 38 64 0D FC 5D 7D 1D 05 CE 7F 1D 81 E0

here is the serial number for the cert: 28 A9 29 38 64 0D FC 5D 7D 1D 05 CE 7F 1D 81 E0

我注意到以下，雪豹，如果我去的java preferences的高级设置并启用检查证书使用CRL吊销我得到同样的问题，因为在狮子。

I noticed the following, on snow leopard, if I go to advanced settings of java preferences and enable "Check certificates for revocation using CRL" I get the same issue as in lion.

我检查的java狮子preferences和选项被禁用尚未证书仍吊销

I check lion java preferences and the option was disabled yet the certificate is still revoked

在雪豹，我再次禁用选项，一切工作正常。

On snow leopard, I disabled the option again and everything works fine

推荐答案

也许Java中的钥匙串访问应用程序使用全球preference设置？
此应用程序可在应用程序>工具>钥匙串访问被发现。

Maybe Java uses the global preference settings in the "Keychain Access" application? This application can be found under Applications > Utilities > Keychain Access.

默认设置指示：

Online Certificate Status Protocol (OCSP): Best attempt
Certificate Revocation List (CSP): Best attempt
Priority: OCSP

如果应用程序接受您的证书，如果你（临时）转OCSP和CRL关你可以验证。

You could verify if the application accepts your certificate if you (temporarily) turn OCSP and CRL off.

在任何情况下，你可能不应该使用吊销的证书...： - ）

In any case, you should probably not be using a revoked certificate... :-)

这篇关于Java的签署仅在Mac OSX10.7吊销证书的小程序（狮子）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！