title: Java signed applet certificate revoked only on mac OSX10.7 (Lion)
body: <p>I have a signed applet that works fine on windows, Mac &lt;= 10.6, and linux. However, on OSX lion, the signing certificate is revoked. Here is the security debug info from the java console:</p>
  
  <pre><code>security: Loading certificates from Deployment session certificate store
  security: Loaded certificates from Deployment session certificate store
  security: Loading Root CA certificates from from keychain
  security: Loaded Root CA certificates from from keychain
  security: Validate the certificate chain using CertPath API
  security: Obtain certificate collection in Root CA certificate store
  security: Obtain certificate collection in Root CA certificate store
  security: Obtain certificate collection in Root CA certificate store
  security: jpicertstore.cert.getkeystore
  security: No timestamping info available
  security: Cannot find jurisdiction list file
  security: The CRL support is enabled
  security: PC Operating Center
  security: ObjectId: 2.5.29.31 Criticality=false
  CRLDistributionPoints [
    [DistributionPoint:
       [URIName: http://crl.thawte.com/ThawteCodeSigningCA.crl]
  ]]
  
  security: Thawte Code Signing CA
  security: ObjectId: 2.5.29.31 Criticality=false
  CRLDistributionPoints [
    [DistributionPoint:
       [URIName: http://crl.thawte.com/ThawtePremiumServerCA.crl]
  ]]
  
  security: Use CRL setting from certificate
  security: The OCSP support is enabled
  security: PC Operating Center
  security: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
  AuthorityInfoAccess [
    [
     accessMethod: 1.3.6.1.5.5.7.48.1
     accessLocation: URIName: http://ocsp.thawte.com]
  ]
  
  security: This certificate does not have AIA extension
  security: Use OCSP setting from certificate
  network: Cache entry not found [url: http://crl.thawte.com/ThawtePremiumServerCA.crl, version: null]
  network: Connecting http://crl.thawte.com/ThawtePremiumServerCA.crl with proxy=DIRECT
  network: Connecting http://crl.thawte.com:80/ with proxy=DIRECT
  network: Downloading resource: http://crl.thawte.com/ThawtePremiumServerCA.crl
      Content-Length: 181,278
      Content-Encoding: null
  network: Wrote URL http://crl.thawte.com/ThawtePremiumServerCA.crl to File /Users/koutbo6/Library/Caches/Java/cache/6.0/38/2fb889a6-30a08967-temp
  network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
  network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
  network: CleanupThread used 990300 us
  network: Connecting http://ocsp.thawte.com/ with proxy=DIRECT
  network: Connecting http://ocsp.thawte.com:80/ with proxy=DIRECT
  security: This certificate has been revoked
  Ignored exception: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Certificate has been revoked
  </code></pre>
  
  <p>Would appreciate any tips on how to get the signed applet to work on Lion.</p>
  
  <p>UPDATE:</p>
  
  <p>here is the serial number for the cert: 28 A9 29 38 64 0D FC 5D 7D 1D 05 CE 7F 1D 81 E0</p>
  
  <p>I noticed the following, on snow leopard, if I go to advanced settings of java preferences and enable "Check certificates for revocation using CRL" I get the same issue as in lion.</p>
  
  <p>I check lion java preferences and the option was disabled yet the certificate is still revoked</p>
  
  <p>On snow leopard, I disabled the option again and everything works fine</p>