这是code签名证书有效期为签署小应用程序？ [英] Is this code signing certificate valid for signing applets?

问题描述

我们购买了code签名证书签署的小程序，但签署的applet，当我们得到以下错误。

  C：\\ CM \\ WEB-INF＆GT;的jarsigner -keystore code_signing.keystore C：\\ CM \\ SweetApplet.jar code_signing_real
输入口令密钥库：
    的jarsigner：证书链没有找到：code_signing_real。 code_signing_real必须引用包含私钥和对应的公钥证书链有效的密钥仓库密钥项。
 

是我们的证书不正确？下面是下面问题的证书。该错误消息似乎表明该证书必须包含私钥，但我们不知道如何这可能是因为私有密钥从不应该得到暴露给任何人，但我们。

  C：\\ CM \\ WEB-INF＆GT;的keytool -list -keystore code_signing.keystore -alias code_signing_real -v
输入密钥库密码：
别名：code_signing_real
创建日期：2014年3月13日
条目类型：trustedCertEntry业主：CN = CE，OU = CE，O = CE，L = PAL
ØALTO，ST =加州，C = US
发行人：CN ​​= Thawte的code签名CA  -  G2，O =Thawte的公司，C = US
编号：728b78e4ded46af26494c59690e428f0
有效期从：周三3月12日17:00:00 PDT 2014年至：周五03月11日15时59分59秒的PST 2016年
证书指纹：
         MD5：E0：DB：9E：DC：37：1E：C2：A9：EA：C0：A8：21：22：61：9F：DD
         SHA1：F9：C3：75：37：CA：86：4D：E2：11：BE：52：79：CE：FA：B3：6B：32：F0：CF：D2
         签名算法名：SHA1withRSA
         版本：3扩展：＃1：的ObjectId：2.5.29.19临界= TRUE
BasicConstraints：
  CA：FALSE
  pathLen不能：未定义
]＃2：的ObjectId：1.3.6.1.5.5.7.1.1临界= FALSE
AuthorityInfoAccess [
  [accessMethod：1.3.6.1.5.5.7.48.1
   accessLocation：URIName：http://ocsp.thawte.com]
]＃3：的ObjectId：2.5.29.4临界= FALSE＃4：的ObjectId：2.5.29.31临界= FALSE
CRLDistributionPoints [
  [DistributionPoint：
     [URIName：http://cs-g2-crl.thawte.com/ThawteCSG2.crl]
]]＃5：的ObjectId：2.5.29.37临界= FALSE
ExtendedKeyUsages [
  codeSigning
  1.3.6.1.4.1.311.2.1.22
]＃6：的ObjectId：2.16.840.1.113730.1.1临界= FALSE
NetscapeCertType [
   对象签名
]
 

解决方案

这并不是说该证书必须包含一个私钥。证书不包含私有密钥。看了一遍。它说的键进入的必须包含一个私钥的和的证书。

所以，不管你建造该密钥存储，它是无效的。也许你刚刚导入的签名证书到一个新的密钥库，或者用一个新的别名。你必须将其导入到原始密钥库所在的私钥，具有相同的别名作为私钥。

您还必须导入证书链，为可信CA证书，另有别名。

We purchased a code signing certificate for signing applets, but we get the following error when signing an applet.

    C:\CM\WEB-INF>jarsigner -keystore code_signing.keystore C:\CM\SweetApplet.jar code_signing_real
Enter Passphrase for keystore:
    jarsigner: Certificate chain not found for: code_signing_real.  code_signing_real must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

Is our certificate not correct? Here's the certificate in question below. The error message seems to suggest the certificate must contain a private key, but we don't understand how this can be since the private key is never supposed to get exposed to anyone but us.

C:\CM\WEB-INF>keytool -list -keystore code_signing.keystore -alias code_signing_real -v
Enter keystore password:
Alias name: code_signing_real
Creation date: Mar 13, 2014
Entry type: trustedCertEntry

Owner: CN=CE, OU=CE, O=CE, L=PAL
O ALTO, ST=California, C=US
Issuer: CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US
Serial number: 728b78e4ded46af26494c59690e428f0
Valid from: Wed Mar 12 17:00:00 PDT 2014 until: Fri Mar 11 15:59:59 PST 2016
Certificate fingerprints:
         MD5:  E0:DB:9E:DC:37:1E:C2:A9:EA:C0:A8:21:22:61:9F:DD
         SHA1: F9:C3:75:37:CA:86:4D:E2:11:BE:52:79:CE:FA:B3:6B:32:F0:CF:D2
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:

#1: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

#2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [accessMethod: 1.3.6.1.5.5.7.48.1
   accessLocation: URIName: http://ocsp.thawte.com]
]

#3: ObjectId: 2.5.29.4 Criticality=false

#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://cs-g2-crl.thawte.com/ThawteCSG2.crl]
]]

#5: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  codeSigning
  1.3.6.1.4.1.311.2.1.22
]

#6: ObjectId: 2.16.840.1.113730.1.1 Criticality=false
NetscapeCertType [
   Object Signing
]

解决方案

It doesn't say the certificate must contain a private key. Certificates don't contain private keys. Read it again. It says the key entry must contain a private key and a certificate.

So however you constructed this KeyStore, it is invalid. Probably you just imported the signed certificate into a new KeyStore, or with a new alias. You must import it into the original KeyStore where the private key is, with the same alias as the private key.

You must also import the certificate chain, as trusted CA certificates, with another alias.

这篇关于这是code签名证书有效期为签署小应用程序？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！