Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

is OWS ignoring timestamps in expired code-signing-certificates? #610

Open
AlBundy33 opened this issue Dec 20, 2024 · 0 comments
Open

is OWS ignoring timestamps in expired code-signing-certificates? #610

AlBundy33 opened this issue Dec 20, 2024 · 0 comments

Comments

@AlBundy33
Copy link

our code signing certificae expired this month we have timestamped the signature.
When we try to start our application OWS complains about an expired certificate.
image
image
image

But If I check the certificate on command line all is fine

jarsigner -verify -verbose org.ehcache_3.9.6.jar
...
  s = signature was verified
  m = entry is listed in manifest
  k = at least one certificate was found in keystore

- Signed by "...our certificate..."
    Digest algorithm: SHA-256
    Signature algorithm: SHA256withRSA, 4096-bit key
  Timestamped by "CN=DigiCert Timestamp 2023, O="DigiCert, Inc.", C=US" on Mi. Okt. 18 08:39:52 UTC 2023
    Timestamp digest algorithm: SHA-256
    Timestamp signature algorithm: SHA256withRSA, 4096-bit key

jar verified.

The signer certificate expired on 2024-12-10. However, the JAR will be valid until the timestamp expires on 2031-11-10.

(don't worry about org.ehcache_3.9.6.jar - we've resigned all jars with our certificate)

@AlBundy33 AlBundy33 changed the title is OWS ignoring timestamps in expired certificates? is OWS ignoring timestamps in expired code-signing-certificates? Dec 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant