Questions about code signing cert.

java-programmer, Questions about code signing cert. Martin Chan wrote:

> 2. What will happen when if people use my application after my
> certificate has expired?

After the expiration date the certificate
cannot be used to sign applications.

The date has no implications for the execution
of already signed applications.

java-programmer >> Questions about code signing cert. If you are talking about using the certificate to sign code
for JavaPlugin deployment, the Security Warning on applet
startup will advise you that the certificate has expired (JavaPlugin 1.3.1+),
but you can choose to allow it to run. (earlier plugins would not allow the
applet to run at all!).

Since jarsigner does not timestamp the jar archive, the verification process
cannot determine if the signature was generated potentially (via hacking) after
the cert was expired. Hence the warning.

- Mitch Gallant
http://pages.istar.ca/~neutron

"Jacob" <email***@***.com> wrote in message news:email***@***.com...
> Martin Chan wrote:
>
>
> > 2. What will happen when if people use my application after my
> > certificate has expired?
>
> After the expiration date the certificate
> cannot be used to sign applications.
>
> The date has no implications for the execution
> of already signed applications.
>
>
>
>
>
>
>

java-programmer >> Questions about code signing cert. "Roedy Green" <email***@***.com> wrote in message
news:email***@***.com...
> On Mon, 14 Jul 2003 19:27:28 +0800, Martin Chan
> <email***@***.com> wrote or quoted :
>
> >2. What will happen when if people use my application after my
> >certificate has expired?
>
> They will get a message saying it has expired. It will be much like
> using a phony cert. They can decide to go ahead or not. Presumably
> clever folk can control it via policy files too.

No, there should be no problem continuing to use the application after the
certificate expires. The expiration date is a date when that certificate can
no longer be used to sign new things. Things that are signed before the
expiration date continue to be valid.

This is logical, because the signature says that it really did come from
this person. If it came from that person on one day, it doesn't suddenly
change the next day to not come from that person.

See
http://e-commerce.seattleu.edu/Security/what_are_digital_certificates.htm
which says:

"To further reduce the possibility that someone will derive a private key
from its public key, the certifying authority timestamps the key pair so
that they must be replaced periodically, and provides an additional
mechanism to assure that a signature was applied before the certificate
expired. Any signature applied during the active lifetime of the digital
certificate will remain valid for an unlimited time (unless the signed item
is tampered with or the signature is removed). Any signature applied after
the digital certificate expires is invalid."