jarsigner：此jar包含其证书链未经验证的条目

Z时代
2024-01-10
分类：问答

我正在尝试对JAR文件进行代码签名，并且正在使用JDK
1.7u1。我们获得了GoDaddy代码签名证书，我按照此处的说明（方法1）进行操作：http: //help.godaddy.com/article/4780

JAR可以正常运行，但是每当我尝试运行命令时： jarsigner -verify在使用JDK 1.7u1签名的JAR上，我都会得到以下输出：

s        180 Mon Dec 05 10:24:32 EST 2011 META-INF/MANIFEST.MF
      [entry was signed on 12/5/11 10:24 AM]
      X.509, CN=Removed Company Name, O=Removed Company Name, L=Removed City, ST=Removed State, C=US
      [certificate is valid from 12/2/11 4:30 PM to 12/2/13 4:30 PM]
      X.509, SERIALNUMBER=00000000, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US
      [certificate is valid from 11/15/06 8:54 PM to 11/15/26 8:54 PM]
      X.509, OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US
      [certificate is valid from 6/29/04 1:06 PM to 6/29/34 1:06 PM]
      [CertPath not validated: null]
         342 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.SF
        6180 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.RSA
           0 Mon Dec 05 10:24:30 EST 2011 META-INF/
sm      2161 Wed Nov 30 10:23:20 EST 2011 C:/Users/Seth/Desktop/JAR/RunAppSF.class
      [entry was signed on 12/5/11 10:24 AM]
      X.509, CN=Removed Company Name, O=Removed Company Name, L=Removed City, ST=Removed State, C=US
      [certificate is valid from 12/2/11 4:30 PM to 12/2/13 4:30 PM]
      X.509, SERIALNUMBER=00000000, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US
      [certificate is valid from 11/15/06 8:54 PM to 11/15/26 8:54 PM]
      X.509, OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US
      [certificate is valid from 6/29/04 1:06 PM to 6/29/34 1:06 PM]
      [CertPath not validated: null]
  s = signature was verified 
  m = entry is listed in manifest
  k = at least one certificate was found in keystore
  i = at least one certificate was found in identity scope
jar verified.
Warning: 
This jar contains entries whose certificate chain is not validated.

我还在jarsigner -verifyJDK 1.6u26和1.6u14上使用与上述相同的JAR

尝试了该命令，结果返回正常。（输出低于1.6u26）。

180 Mon Dec 05 10:24:32 EST 2011 META-INF/MANIFEST.MF 342 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.SF 6180 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.RSA 0 Mon Dec 05 10:24:30 EST 2011 META-INF/ sm 2161 Wed Nov 30 10:23:20 EST 2011 C:/Users/Seth/Desktop/JAR/RunAppSF.class [entry was signed on 12/5/11 10:24 AM] X.509, CN=Removed Company Name, O=Removed Company Name, L=Removed City, ST=Removed State, C=US [certificate is valid from 12/2/11 4:30 PM to 12/2/13 4:30 PM] X.509, SERIALNUMBER=00000000, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US [certificate is valid from 11/15/06 8:54 PM to 11/15/26 8:54 PM] [KeyUsage extension does not support code signing] X.509, OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US [certificate is valid from 6/29/04 1:06 PM to 6/29/34 1:06 PM] s = signature was verified m = entry is listed in manifest k = at least one certificate was found in keystore i = at least one certificate was found in identity scope jar verified.

我是否缺少为使JDK 1.7正确签名JAR而需要采取的额外步骤？