如果我将计算机上的时钟提前，签名的 Java 小程序将不再在任何浏览器中运行

Question

I have a Java Applet (for a browser) signed and timestamped with a valid Code Signing Certificate from GoDaddy. The code signing certificate itself expires in a few weeks. Everything I've read says that the applet will still be valid after the Code Signing Certificate expires:

From here :

If a timestamp is discovered, then the code signature is valid until the end of time, as long as the code remains unchanged

I would like to verify this is actually true though. If I change my computer's clock settings to a later date, past when the certificate expires, I get the following Java Exception in IE, Firefox and Chrome:

java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Response is unreliable: its validity interval is out-of-date

Does this mean that the applet will actually fail in a few weeks when the Code Signing Certificate expires, or is this test of changing my computer clock just invalid? Any references either way?

Answer 1

The code Signing Certificate has expired several months ago now, and I can confirm everything is still working fine. The Java popup that comes up (the first time visiting the site) says: "The web site's certificate has been verified."

Changing the local timestamp wasn't a valid test of this after all.

Answer 2

As @Gabriel pointed out in a comment to the original question the problem you experienced was due to revocation checking.

I experienced this while testing with safari, and worked around it by configuring java to allow certificates to be trusted even if revocation status could not be verified, and not to check for certificate revocation.

See the following screen shots from the java console.

Answer 3

尝试在您的设备上设置正确的日期它应该可以工作