We have several web sites hosted on AWS that are all signed with a Sectigo signed SSL certificate. One of these web sites hosts a Java applet/webstart application which worked fine up until May 31, 2020 when the Sectigo AddTrust-External-CA-Root certificate expired.
Since then going to the web site in any browser shows that the web site is secure, but when trying to download the jar file, Java 8u252 complains that the web site is untrusted. This despite the Sectigo knowledge base page saying that Java8u51 or higher should just work. It does for connections made from a Java application, but not for loading the application itself either via WebStart or as an applet.
Our certificate is issued with this intermediate certificate which is issued by COMODO RSA Certification Authority.
My understanding based on the description of cross-signed certificates is that COMODO RSA Certification Authority can be either this certificate (which just expired), this one (issued by this one) or this one. All of these certificate are installed in the cacerts Java file as well as the Windows certificate manager, yet for some reason Java always wants to use the expired one.
I'm not even sure where Java is getting the certificate from. I've removed the expired certificate from cacerts and even gone as far as deleting the cacerts file and Java still uses the expired certificate.
Any idea why Java is using the old expired certificate and how to get it to use the valid one?
>keytool -list -storepass changeit -keystore cacerts | find "AF:E5:D2:44:A8:D1:19:42:30:FF:47:9F:E2:F8:97:BB:CD:7A:8C:B4"
Certificate fingerprint (SHA1): AF:E5:D2:44:A8:D1:19:42:30:FF:47:9F:E2:F8:97:BB:CD:7A:8C:B4
>keytool -list -storepass changeit -keystore cacerts | find "D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49"
Certificate fingerprint (SHA1): D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49
***
adding as trusted cert:
Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB
Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
Algorithm: RSA; Serial number: 0x2766ee56eb49f38eabd770a2fc84de22
Valid from Tue May 30 06:48:38 EDT 2000 until Sat May 30 06:48:38 EDT 2020
Found trusted certificate:
[
[
Version: V3
Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB
Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12
Key: Sun RSA public key, 4096 bits
params: null
modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659
public exponent: 65537
Validity: [From: Tue May 30 06:48:38 EDT 2000,
To: Sat May 30 06:48:38 EDT 2020]
Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]