Directory Studio
  1. Directory Studio
  2. DIRSTUDIO-741

Update site has self-signed cert that expired months before the 1.5.3 release


    • Type: Bug Bug
    • Status: Reopened
    • Priority: Major Major
    • Resolution: Unresolved
    • Affects Version/s: 1.5.3
    • Fix Version/s: 2.0.0
    • Component/s: studio-updatesite
    • Labels:



      I was just trying to install Apache Directory Studio 1.5.3 from within Eclipse 3.7. It's saying that the certificate signing the software (or maybe the update site) is both self-signed and expired in January 2010. This is a bit more worrying than even having no certificate, since the 1.5.3 release is from April 2010, and I'm kind of puzzled that it was signed with a certificate that was already several months out of date when the release was made, in addition to being self-signed. I'm also trying this more than a year after the 1.5.3 release occurred, so the fact that the situation remains as I've described is quite worrying from the perspective of having security issues noticed and addressed in a timely fashion.

      There are many valid ways to handle the issue of code signing, including deciding that it's not useful security to do it at all, making an Apache-specific certificate authority, or paying for a commercial certificate as is done for the * HTTPS web sites. The current situation with the Eclipse update site encourages false guarantees of security and, if Apache's users are taught to ignore such warnings, exposes them to man-in-the-middle or other malicious attacks when they think they are being protected by the security reputation of the Apache Software Foundation.

      The time estimate I have given is assuming you decide to generate some new certificate by whatever commercial or non-commercial method, and may include the time to deal with a vendor and/or rebuild the software. If you simply decide to switch your repository to unsigned, my estimate will probably be too large.


        No work has yet been logged on this issue.


          • Assignee:
            Pierre-Arnaud Marcelot
            Jimmy Kaplowitz
          • Votes:
            0 Vote for this issue
            1 Start watching this issue


            • Created:

              Time Tracking

              Original Estimate - 2h
              Remaining Estimate - 2h
              Time Spent - Not Specified
              Not Specified