Java 签名的小程序证书仅在 mac OSX10.7 (Lion) 上被吊销

Question

我有一个签名的小程序，可以在 Windows、Mac <= 10.6 和 Linux 上正常运行。但是，在 OSX lion 上，签名证书被撤销。以下是来自 java 控制台的安全调试信息：

security: Loading certificates from Deployment session certificate store
security: Loaded certificates from Deployment session certificate store
security: Loading Root CA certificates from from keychain
security: Loaded Root CA certificates from from keychain
security: Validate the certificate chain using CertPath API
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: Obtain certificate collection in Root CA certificate store
security: jpicertstore.cert.getkeystore
security: No timestamping info available
security: Cannot find jurisdiction list file
security: The CRL support is enabled
security: PC Operating Center
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.thawte.com/ThawteCodeSigningCA.crl]
]]

security: Thawte Code Signing CA
security: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.thawte.com/ThawtePremiumServerCA.crl]
]]

security: Use CRL setting from certificate
security: The OCSP support is enabled
security: PC Operating Center
security: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: 1.3.6.1.5.5.7.48.1
   accessLocation: URIName: http://ocsp.thawte.com]
]

security: This certificate does not have AIA extension
security: Use OCSP setting from certificate
network: Cache entry not found [url: http://crl.thawte.com/ThawtePremiumServerCA.crl, version: null]
network: Connecting http://crl.thawte.com/ThawtePremiumServerCA.crl with proxy=DIRECT
network: Connecting http://crl.thawte.com:80/ with proxy=DIRECT
network: Downloading resource: http://crl.thawte.com/ThawtePremiumServerCA.crl
    Content-Length: 181,278
    Content-Encoding: null
network: Wrote URL http://crl.thawte.com/ThawtePremiumServerCA.crl to File /Users/koutbo6/Library/Caches/Java/cache/6.0/38/2fb889a6-30a08967-temp
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
network: CleanupThread used 990300 us
network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
security: This certificate has been revoked
Ignored exception: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate has been revoked

如果有任何关于如何让签名小程序在 Lion 上工作的提示，我们将不胜感激。

更新：

这里是证书的序列号：28 A9 29 38 64 0D FC 5D 7D 1D 05 CE 7F 1D 81 E0

如果我进入java首选项的高级设置并启用“检查证书”，我在雪豹上注意到以下内容使用 CRL 进行撤销”我遇到了与 lion 中相同的问题。

我检查了 lion java 首选项，该选项已被禁用，但证书仍被撤销

在雪豹上，我再次禁用了该选项，一切正常

Answer 1

也许 Java 使用“钥匙串访问”应用程序中的全局首选项设置？
该应用程序可以在“应用程序”>“应用程序”下找到。公用事业>钥匙串访问。

默认设置表示：

Online Certificate Status Protocol (OCSP): Best attempt
Certificate Revocation List (CSP): Best attempt
Priority: OCSP

如果您（暂时）关闭 OCSP 和 CRL，则可以验证应用程序是否接受您的证书。

无论如何，您可能不应该使用已吊销的证书...:-)

Answer 2

您是否在以前从未运行过您的小程序的非 Lion 机器上尝试过？也许您测试过的其他机器已经信任您的小程序。