title: JDK 1.7 jarsigner with https tsa no longer works
body: <p>It seems like Thawte root certificates in JDK 1.7.0_80 is revoked.
  <a href="https://www.thawte.com/roots/retired.html" rel="nofollow">https://www.thawte.com/roots/retired.html</a></p>
  
  <p>Using the 7u80 jarsigner no longer works and it worked fine just a few days ago.</p>
  
  <pre><code>/usr/java/jdk1.7.0_80/jre/../bin/jarsigner -keystore /home/build/keystore.p12 -storepass storepass -storetype pkcs12 -tsa https://timestamp.geotrust.com/tsa /home/build/jenkins/workspace/my-gui/target/my-gui-3.0.29-SNAPSHOT.jar comp
  jarsigner: unable to sign jar: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
  </code></pre>
  
  <p>I tried to import Thawtes Timestamping CA certificate into cacerts after deleting the old one.</p>
  
  <pre><code>wget https://www.thawte.com/roots/Thawte_Timestamping_CA.pem
  
  /usr/java/jdk1.7.0_80/bin/keytool -import -trustcacerts -alias verisigntsaca -file Thawte_Timestamping_CA.pem -keystore jre/lib/security/cacerts 
  Enter keystore password:  
  Trust this certificate? [no]:  yes
  Certificate was added to keystore
  </code></pre>
  
  <p>Using jarsigner from JDK 8u60 works, so I tried to copy its cacerts to JDK7, but that did not work either.</p>
  
  <p>We cannot compile yet with Java 8, because of Javadoc errors. The only solutions I see is to create symlink in JDK7 to JDK8 jarsigner.</p>
  
  <pre><code>/usr/java/jdk1.8.0_60/jre/../bin/jarsigner -keystore /home/build/keystore.p12 -storepass storepass -storetype pkcs12 -tsa https://timestamp.geotrust.com/tsa /home/build/jenkins/workspace/my-gui/target/my-gui-3.0.29-SNAPSHOT.jar comp
  jar signed.
  </code></pre>
  
  <p>If I switch tsa from geotrust to digicert it works fine with JDK 7, because they do not use https.
  <a href="http://timestamp.digicert.com/" rel="nofollow">http://timestamp.digicert.com/</a></p>