[MSHARED-299] Add support for -tsa during signing (Trusted Timestamping)

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: maven-jarsigner-1.0
• Fix Version/s: maven-jarsigner-1.1
• Component/s: maven-jarsigner
• Assignee: Tony Chemit
• Reporter: Tony Chemit
• Created: 08/Nov/13 11:00
• Updated: 12/Nov/13 09:28
• Resolved: 08/Nov/13 12:19

Description

Trusted Timestamping, introduced in Java 5 (2004), allows your customers to validate your signature even after the certificate has expired. When you sign a JAR file, the Timestamp Authority uses their clock to act as a notary and cryptographically write the date and time into your file.
Without this timestamp, users would only be able to validate your signature based on their current date and time. This could be problematic for long-running or embedded systems because the standard X.509 Certificates contain a NotAfter date that typically ranges from one to four years.

You interact with timestamp authorities when signing code with jarsigner’s TSA argument:

jarsigner -tsa http://timestamp.verisign.com …

When your signed file provides a timestamp, Java is able to use that information within the PKIXParameters and determine:

• Do I trust this timestamp authority to act as a notary?
• Is the signature date before the certificate’s time of expiration?
• Based on Certificate Revocation Lists, was this certificate valid on or before the signature date?
• If the answer to all questions is yes, then the signature is deemed valid even if the certificate has expired. Therefore, signed code on embedded devices will continue to operate beyond the Certificate’s lifetime.

Issue Links

• is depended upon by: MJARSIGNER-16 Add the option -tsa to the configuration