Java 签名小程序证书仅在 mac OSX10.7 (Lion) 上吊销 [英] Java signed applet certificate revoked only on mac OSX10.7 (Lion)

问题描述

我有一个签名的小程序，可以在 Windows、Mac <= 10.6 和 linux 上正常工作.但是，在 OSX lion 上，签名证书被撤销.这是来自 java 控制台的安全调试信息:

I have a signed applet that works fine on windows, Mac <= 10.6, and linux. However, on OSX lion, the signing certificate is revoked. Here is the security debug info from the java console:

security: Loading certificates from Deployment session certificate store
security: Loaded certificates from Deployment session certificate store
security: Loading Root CA certificates from from keychain
security: Loaded Root CA certificates from from keychain
security: Validate the certificate chain using CertPath API
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: jpicertstore.cert.getkeystore
security: No timestamping info available
security: Cannot find jurisdiction list file
security: The CRL support is enabled
security: PC Operating Center
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.thawte.com/ThawteCodeSigningCA.crl]
]]

security: Thawte Code Signing CA
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.thawte.com/ThawtePremiumServerCA.crl]
]]

security: Use CRL setting from certificate
security: The OCSP support is enabled
security: PC Operating Center
security: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: 1.3.6.1.5.5.7.48.1
   accessLocation: URIName: http://ocsp.thawte.com]
]

security: This certificate does not have AIA extension
security: Use OCSP setting from certificate
network: Cache entry not found [url: http://crl.thawte.com/ThawtePremiumServerCA.crl, version: null]
network: Connecting http://crl.thawte.com/ThawtePremiumServerCA.crl with proxy=DIRECT
network: Connecting http://crl.thawte.com:80/ with proxy=DIRECT
network: Downloading resource: http://crl.thawte.com/ThawtePremiumServerCA.crl
    Content-Length: 181,278
    Content-Encoding: null
network: Wrote URL http://crl.thawte.com/ThawtePremiumServerCA.crl to File /Users/koutbo6/Library/Caches/Java/cache/6.0/38/2fb889a6-30a08967-temp
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
network: CleanupThread used 990300 us
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
security: This certificate has been revoked
Ignored exception: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate has been revoked

非常感谢有关如何让已签名的小程序在 Lion 上运行的任何提示.

Would appreciate any tips on how to get the signed applet to work on Lion.

更新:

这是证书的序列号:28 A9 29 38 64 0D FC 5D 7D 1D 05 CE 7F 1D 81 E0

here is the serial number for the cert: 28 A9 29 38 64 0D FC 5D 7D 1D 05 CE 7F 1D 81 E0

我注意到以下情况，在雪豹上，如果我转到 Java 首选项的高级设置并启用使用 CRL 检查吊销证书"，我会遇到与 Lion 相同的问题.

I noticed the following, on snow leopard, if I go to advanced settings of java preferences and enable "Check certificates for revocation using CRL" I get the same issue as in lion.

我检查了 lion java 首选项，该选项已禁用，但证书仍被吊销

I check lion java preferences and the option was disabled yet the certificate is still revoked

在雪豹上，我再次禁用了该选项，一切正常

On snow leopard, I disabled the option again and everything works fine

推荐答案

也许 Java 在钥匙串访问"应用程序中使用了全局首选项设置?可以在应用程序 > 实用工具 > 钥匙串访问下找到此应用程序.

Maybe Java uses the global preference settings in the "Keychain Access" application? This application can be found under Applications > Utilities > Keychain Access.

默认设置表示:

Online Certificate Status Protocol (OCSP): Best attempt
Certificate Revocation List (CSP): Best attempt
Priority: OCSP

如果您(暂时)关闭 OCSP 和 CRL，您可以验证应用程序是否接受您的证书.

You could verify if the application accepts your certificate if you (temporarily) turn OCSP and CRL off.

无论如何，您可能不应该使用已撤销的证书... :-)

In any case, you should probably not be using a revoked certificate... :-)

这篇关于Java 签名小程序证书仅在 mac OSX10.7 (Lion) 上吊销的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！