【发布时间】：2011-10-15 16:00:11
【问题描述】：
我有一个签名的小程序，可以在 Windows、Mac
security: Loading certificates from Deployment session certificate store
security: Loaded certificates from Deployment session certificate store
security: Loading Root CA certificates from from keychain
security: Loaded Root CA certificates from from keychain
security: Validate the certificate chain using CertPath API
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: jpicertstore.cert.getkeystore
security: No timestamping info available
security: Cannot find jurisdiction list file
security: The CRL support is enabled
security: PC Operating Center
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
[URIName: http://crl.thawte.com/ThawteCodeSigningCA.crl]
]]
security: Thawte Code Signing CA
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
[URIName: http://crl.thawte.com/ThawtePremiumServerCA.crl]
]]
security: Use CRL setting from certificate
security: The OCSP support is enabled
security: PC Operating Center
security: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[
accessMethod: 1.3.6.1.5.5.7.48.1
accessLocation: URIName: http://ocsp.thawte.com]
]
security: This certificate does not have AIA extension
security: Use OCSP setting from certificate
network: Cache entry not found [url: http://crl.thawte.com/ThawtePremiumServerCA.crl, version: null]
network: Connecting http://crl.thawte.com/ThawtePremiumServerCA.crl with proxy=DIRECT
network: Connecting http://crl.thawte.com:80/ with proxy=DIRECT
network: Downloading resource: http://crl.thawte.com/ThawtePremiumServerCA.crl
Content-Length: 181,278
Content-Encoding: null
network: Wrote URL http://crl.thawte.com/ThawtePremiumServerCA.crl to File /Users/koutbo6/Library/Caches/Java/cache/6.0/38/2fb889a6-30a08967-temp
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
network: CleanupThread used 990300 us
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
security: This certificate has been revoked
Ignored exception: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate has been revoked
如果有任何关于如何让签名的小程序在 Lion 上运行的提示，我们将不胜感激。
更新：
这是证书的序列号：28 A9 29 38 64 0D FC 5D 7D 1D 05 CE 7F 1D 81 E0
我注意到，在雪豹上，如果我进入 java 首选项的高级设置并启用“使用 CRL 检查证书是否吊销”，我会遇到与狮子相同的问题。
我检查了 lion java 首选项，该选项被禁用，但证书仍然被吊销
在雪豹上，我再次禁用了该选项，一切正常
【问题讨论】：
-
你知道为什么你的证书被吊销了吗？这不依赖于操作系统；其他操作系统不能检查 CRL。
-
我完全不知道，如果有任何关于如何找出原因的指示，我将不胜感激。但正如我所说，这种行为只在 Lion 上观察到，签名的小程序在雪豹上运行良好，并且证书没有被吊销
-
您有证书副本吗？或者至少是序列号？
-
你能检查每台机器上的链条是否相同吗？也许更新了 CA 证书？
-
等一下，其他机器上是否开启了OCSP？您确定 OCSP 服务反应正确吗？
标签： java macos applet certificate osx-lion