title: What happens to Java Web Start application (signed without timestamp) when certificate expires?
body: <p>We have a Java Web Start application signed with a certificate from CA (Thawte). The application is distributed to the hundreds of customers. They hosted it on their servers a run it over the internet or intranet on their client computers. Now it works perfect. Problem is that the application is signed without timestamp. What happens to customers when the certificate expires? Should they be able to start the app? If not, how we can help them? Does adding their server URL to the exception site list help them?</p>
  
  <p>We tried to change the local time to pretend certificate expiration. Then application is blocked due to security. Adding the URL to the exception site list doesn't help:</p>
  
  <pre><code>java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Response is unreliable: its validity interval is out-of-date
  at com.sun.deploy.security.RevocationChecker.checkOCSP(Unknown Source)
  at com.sun.deploy.security.RevocationChecker.check(Unknown Source)
  at com.sun.deploy.security.TrustDecider.checkRevocationStatus(Unknown Source)
  at com.sun.deploy.security.TrustDecider.getValidationState(Unknown Source)
  at com.sun.deploy.security.TrustDecider.validateChain(Unknown Source)
  at com.sun.deploy.security.TrustDecider.isAllPermissionGrantedInt(Unknown Source)
  at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(Unknown Source)
  at com.sun.javaws.security.AppPolicy.grantUnrestrictedAccess(Unknown Source)
  at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResourcesHelper(Unknown Source)
  at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResources(Unknown Source)
  at com.sun.javaws.Launcher.prepareResources(Unknown Source)
  at com.sun.javaws.Launcher.prepareAllResources(Unknown Source)
  at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
  at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
  at com.sun.javaws.Launcher.launch(Unknown Source)
  at com.sun.javaws.Main.launchApp(Unknown Source)
  at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
  at com.sun.javaws.Main.access$000(Unknown Source)
  at com.sun.javaws.Main$1.run(Unknown Source)
  at java.lang.Thread.run(Unknown Source)
  Suppressed: com.sun.deploy.security.RevocationChecker$StatusUnknownException
      at com.sun.deploy.security.RevocationChecker.checkCRLs(Unknown Source)
      ... 19 more
  Caused by: java.security.cert.CertPathValidatorException: Response is unreliable: its validity interval is out-of-date
  at sun.security.provider.certpath.OCSPResponse.verify(Unknown Source)
  at sun.security.provider.certpath.OCSP.check(Unknown Source)
  at sun.security.provider.certpath.OCSP.check(Unknown Source)
  at sun.security.provider.certpath.OCSP.check(Unknown Source)
  at com.sun.deploy.security.RevocationChecker$2.run(Unknown Source)
  at com.sun.deploy.security.RevocationChecker$2.run(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at com.sun.deploy.security.RevocationChecker.doPrivilegedOCSPCheck(Unknown Source)
  ... 20 more
  </code></pre>
  
  <p>What we can do? Sure, we asked Thawte for renew our certificate and going to ask our customers for upgrade to resigned application. But we cannot cover all of them. We need to have some quick advice for them when they ask us. The expiration time is coming so any comments are welcome. </p>