When a TSA is not accessible, jarsigner would print out:

jarsigner: unable to sign jar: no response from the Timestamping Authority. When connecting from behind a firewall then an HTTP proxy may need to be specified. Supply the following options to jarsigner:
  -J-Dhttp.proxyHost=<hostname>
  -J-Dhttp.proxyPort=<portnumber>

In fact, most TSAs are behind SSL, and I've already seen several customers complaining the system properties do not work. In this case, they should be https.proxyHost and https.proxyPort.