Windows x64 Preview 2 jarsigner.exe Code Signing Problem about corretto-8

[yoroto]

Hi Joe,

Thank you for reporting the issue!

I looked into it and the reason you received that warning was because the certs store of Corretto does not include the 'Thawte Timestamping CA' cert (https://www.thawte.com/roots/) while both Oracle and AdoptOpenJDK have. The cert store in Corretto is the same as Amazon Linux.

You can manually import the cert into your cert store using keytool:

keytool -import -trustcacerts -keystore <path to cacerts> -alias verisigntsaca -file TimestampCA.cer -storepass changeit

Please let me know whether it fixed your issue! If you have any other concern or thought about the cert store, please also let us know! Thanks!

Letu

[prevoj]

Thanks, I got it to work but not by using that CA certificate. I had to get the UTN-USERFirst-Object CA from https://www.tbs-certificates.co.uk/FAQ/en/97.html to get the warning to go away. I checked and both Oracle and AdoptOpenJDK have it but Corretto doesn't.

While it is now fixed for me, it would be nice if Corretto's cacerts file contained the same base set of certs as the other JDKs do (and extras added by Corretto would be fine as long as the "standard" set is there). Missing certs does not make Corretto a drop-in replacement. I alone had to burn a couple of days fixing this. Comodo is one of the most popular code signing vendors out there so no doubt, many others will run into this same problem too.

All that being said, I want to thank Amazon for providing us with Corretto as an option and for you, Letu, for helping me figure out the problem.

[davecurrie]

@prevoj I addressed the cacert issue in #59. Bottom line, we'll look into it but there isn't a definitive solution to cacerts not being in-sync unless they become something managed in the open. We are looking into how to keep the delta low in the future though.