Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8330217 Spurious warning from jarsigner -verify when keystore with intermediate CA is used
  3. JDK-8334262

Release Note: "Not Signed by Alias in This Keystore" No Longer a Severe Warning

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Unresolved
    • Icon: P4 P4
    • tbd
    • 24
    • security-libs

      The "not signed by alias in this keystore" warning, originally treated as a severe warning that triggered a non-zero exit code if `-strict` was used, has been reclassified. In practice, a signed JAR file is typically verified by someone other than the signer, so it's unrealistic to expect the verifier to have the signer's key or certificate in their local keystore. This warning is now considered informational and does not result in a non-zero exit code. Additionally, the warning's implementation has been updated to only check the signer's end-entity certificate, without considering whether any Certificate Authorities (CAs) associated with it are in the keystore.

            weijun Weijun Wang
            weijun Weijun Wang
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: