Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!peer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post01.iad.highwinds-media.com!fx01.iad.POSTED!not-for-mail From: Wayne User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 Newsgroups: comp.lang.java.programmer Subject: Re: timestamping Jars References: In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Lines: 25 Message-ID: X-Complaints-To: abuse@newshosting.com NNTP-Posting-Date: Wed, 22 Jan 2014 04:46:45 UTC Organization: Newshosting.com - Highest quality at a great price! www.newshosting.com Date: Tue, 21 Jan 2014 23:46:53 -0500 X-Received-Bytes: 1693 X-Received-Body-CRC: 1690096753 Xref: csiph.com comp.lang.java.programmer:27384 On 1/21/2014 12:49 PM, Roedy Green wrote: > The new java lets you timestamp jars and gives a warning message if > you don't. Timestamped jars continue to work even after the > certificate has expired. > > You need a time stamping service that jarsigner can find out the > official time of stamping from using RFC 3161. > > Has anyone found some good cheap, reliable services? > The European Union maintains (as of 2014) a list of approved and trusted TSAs, at . A Google search for "public time stamp authority free" will turn up some, such as www.aloaha.com/wi-software-en/aloaha-timestamping-server.php. To use it, the command would be (one long line): jarsigner -signedjar MySignedApplet.jar -tsa http://card.aloaha.com:8081/tsa.aspx MyApplet.jar mykey (I haven't used any of these yet.) -- Wayne