我们应该在使用相同的 CSR 续订后重新部署 jar 吗？
我们的 Java 代码签名证书将在一个月后到期，我们刚刚通过 Verisign 更新了该证书。我假设这足以避免我们的客户看到任何与证书相关的错误消息。
我们是否应该使用新证书再次对 jar 进行签名并将其重新部署到客户端？
提前致谢
Our Java code signing certificates expires in a month and we just renewed it with Verisign. I was assuming that that would be enough to avoid our clients from seeing any certificate related error messages.
Should we sign the jars again with the new certificate and redeploy it to the clients?
Thanks in advance
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，您需要重新签名。证书本身会告诉您它自己的到期日期，并且证书会与您的包一起部署。这是您获得的全新证书（即使颁发者经常将其称为“续订”）。
安装程序和其他验证软件通常不会使用互联网来检查证书的有效性。相反，他们将检查您的证书文件（打包到签名的 JAR 文件中）中的过期日期，并通过检查计算机的内置颁发者证书 (CA) 列表来检查证书的有效性。在此过程中唯一使用互联网的时间是下载吊销列表（在到期日期之前吊销的证书的数据库），但这通常不会实时完成，而是按计划进行。
Yes, you need to sign them again. The certificate itself will tell it's own expire date, and the certificate is deployed along with your package. It's an entirely new certificate you've got (even if the issuers often refer to it as a "renewal").
Installers and other verification software will usually not use the Internet to check the validity of the certificate. Instead, they will check the expire date in your certificate file (which is packed into the signed JAR file), and check the validity of the certificate by checking against the computes' built-in list of issuer certificates (CA). The only time the Internet is used in this process is to download a revocation list - a database of certificates revoked before their expiry date - but this will usually not be done in realtime, but on a scheduled basis.
，不，如果您在签名过程中使用了时间戳参数，则不会。
请注意在此示例中： https://www.digicert .com/code-signing/java-code-signing-guide.htm#jarsigner
-tsa http:// timestamp.digicert.com 参数
这使得您的签名在可预见的未来有效。如果您使用时间戳，则无需续订和重新签署该特定文件
您只需要续订证书即可对您创建的未来新 jar 文件进行签名
No, not if you used the timestamp parameter in the signing process.
Notice in this example here: https://www.digicert.com/code-signing/java-code-signing-guide.htm#jarsigner
The -tsa http://timestamp.digicert.com parameter
That makes it so that your signature is valid for the foreseeable future. You do not need to renew and resign that specific file if you used the timestamp
You would only need to renew your certificate to sign future new jar files you create
是的。您拥有新的签名证书，并且当前部署的版本是使用旧证书签名的，因此对于您的用户来说就像没有任何变化。
为了使新证书生效，您必须使用新证书再次签署 JAR 文件，并将新签署的文件重新部署到客户端。
Yes. You have new signing certificates, and the versions currently deployed are signed with the old certificate, so it is like nothing changed for your users.
For your new certificate to be taken into account, you have to sign again your JAR files with the new certificate, and redeploy the new signed files to the clients.