问题描述
我正在尝试从Oracle网站下载Windows Java EE安装程序，但是当我检查下载的数字签名时，我不断收到对象的数字签名未验证错误消息文件。
I'm trying to download the Windows Java EE installer from Oracle's website but I continually receive "The digital signature of the object did not verify" error messages when I check the digital signature of the downloaded file.
我在这个网站上尝试了以下搜索（以及Google上的类似搜索没有成功）：
I've tried the following searches on this site (and similar searches on Google with no success):
- java ee +数字签名+未验证
- 1无关结果
- 2无关结果
我已经在3台不同的机器上下载了文件，每台机器运行不同版本的Windows（WinXP 32位， WinVista 32位和Win7 64位）我得到了相同的结果。运行WinXP的机器是我的笔记本电脑，我在2个完全不同的网络上尝试下载文件但没有成功。
I've downloaded the files on 3 separate machines, where each is running a different version of Windows (WinXP 32-bit, WinVista 32-bit & Win7 64-bit) and I get the same result. The machine running WinXP is my laptop, which I have tried on 2 completely different networks to download the files without success.
我下载的文件是（以及证书的序列号和指纹以及签名是否有效）：
The files I have downloaded are (along with the certificate's serial number and thumbprint and whether the signature was valid):
- java_ee_sdk-6u3-jdk7-windows.exe
- 签名无法验证
- 序列号：5e f1 dc 1e fb 1e 46 b5 de 80 ed e1 76 2a 55 a7
- 指纹：9e 2b 73 43 3c 7f f0是9c 2e 54 6c 46 a3 d1 6a 6c da cf 32
- 签名无法验证
- 序列号： 5e f1 dc 1e fb 1e 46 b5 de 80 ed e1 76 2a 55 a7
- 指纹：9e 2b 73 43 3c 7f f0是9c 2e 54 6c 46 a3 d1 6a 6c da cf 32
- 签名验证
- 序列号：5e f1 dc 1e fb 1e 46 b5 de 80 ed e1 76 2a 55 a7
- 指纹：9e 2b 73 43 3c 7f f0是9c 2e 54 6c 46 a3 d1 6a 6c da cf 32
- 签名验证
- 序列号：5e f1 dc 1e fb 1e 46 b5 de 80 ed e1 76 2a 55 a7
- 指纹：9e 2b 73 43 3c 7f f0 be 9c 2e 54 6c 46 a3 d1 6a 6c da cf 32
我已下载JDK 7安装程序作为比较和签名验证。正如您在上面的序列号和指纹所看到的，所有文件都使用相同的证书进行签名。但是，Java EE安装程序未通过签名验证。
I downloaded the JDK 7 installers as a comparison and their signatures verify. As you can see by the serial numbers and thumbprints above, all the files are signed with the same certificate. However, the Java EE installers fail signature verification.
我可以在同一台计算机上同时下载JDK 7安装程序和Java EE安装程序，两个文件都由同一个证书签名，并且具有不同的签名验证结果似乎意味着Java EE安装程序在被Oracle签名和被我收到之间已经损坏。
The fact that I can download both the JDK 7 installer and the Java EE installer on the same machine, on the same network, with both files being signed by the same certificate, and have different signature verification results would seem to imply that the Java EE installer was corrupted between being signed by Oracle and being received by me.
这似乎排除了我的计算机上的证书问题（因为我可以验证JDK 7文件 - 由同一证书签名）并指向中间人攻击或损坏服务器上的文件。但是，如果Oracle推出了一个损坏的文件，我相信我会发现它已经提到了 - 因为这个问题在过去的几周内一直在发生。
This seems to rule out a certificate problem on my machines (since I can verify the JDK 7 file - which is signed by the same certificate) and point to either a man-in-the-middle attack, or a corrupted file on the server. However, if Oracle were pushing out a corrupted file, I'm sure I would have found mention of it - since this problem has been occurring for the past couple of weeks.
当使用不同的网络时问题发生时，中间人攻击的可能性似乎会降低。
The likelihood of a man-in-the-middle attack would appear to be reduced by the fact that the issue occurs when using different networks.
我已经尝试了一切我能想到并且已经空了。
I've tried everything that I can think of and have come up empty.
是否有人知道其他人有这个问题，更重要的是，是否有人对可能导致此问题的原因有任何建议？
Is anyone aware of others having this issue and more importantly, does anyone have any suggestions as to what may be causing this?
推荐答案
我在下载java_ee_sdk-6u4-jdk7-windows-ml后在同一问题的搜索中找到了这个问题。可执行程序;它似乎是反对者证书已过期。在Windows资源管理器中：
I found this question in a search prompted by the same problem after downloading java_ee_sdk-6u4-jdk7-windows-ml.exe; it looks like the countersigner certificate is expired. In Windows Explorer:
- 为文件选择文件>属性
- 打开数字签名标签
- 在签名列表中选择 Oracle America
- 请点击详细信息
- 在 Countersignatures 列表中选择 VeriSign时间戳服务签名者 - G2
- 点击详细信息
- 点击查看证书
- 注意有效期日期是6/14/2012。
- Select File > Properties for the file
- Open the Digital Signatures tab
- Select Oracle America in the signature list
- Click Details
- Select VeriSign Time Stamping Services Signer - G2 in the Countersignatures list
- Click Details
- Click View Certificate
- Note Valid to date is 6/14/2012.
这显然不是2011年9月SlaY3R的具体问题，但它可能是证书路径中不同的过期证书。
That was obviously not the specific problem for SlaY3R in September 2011, but it may have been a different expired cert in the cert path.
这篇关于为什么我一直得到“对象的数字签名没有验证”对于Windows JavaEE安装程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！