title: jarsigner: This jar contains entries whose certificate chain is not validated
body: <p>I'm trying to code sign a JAR file and am using JDK 1.7u1.  We acquired a GoDaddy Code Signing certificate and I followed the instructions (Approach 1) here: <a href="http://help.godaddy.com/article/4780" rel="noreferrer">http://help.godaddy.com/article/4780</a></p>
  
  <p>The JAR signs fine, however whenever I try to run the command:
  <code>jarsigner -verify</code> on my signed JAR using JDK 1.7u1 I get the following output:  </p>
  
  <pre><code>s        180 Mon Dec 05 10:24:32 EST 2011 META-INF/MANIFEST.MF
  
        [entry was signed on 12/5/11 10:24 AM]
        X.509, CN=Removed Company Name, O=Removed Company Name, L=Removed City, ST=Removed State, C=US
        [certificate is valid from 12/2/11 4:30 PM to 12/2/13 4:30 PM]
        X.509, SERIALNUMBER=00000000, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US
        [certificate is valid from 11/15/06 8:54 PM to 11/15/26 8:54 PM]
        X.509, OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US
        [certificate is valid from 6/29/04 1:06 PM to 6/29/34 1:06 PM]
        [CertPath not validated: null]
  
           342 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.SF
          6180 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.RSA
             0 Mon Dec 05 10:24:30 EST 2011 META-INF/
  sm      2161 Wed Nov 30 10:23:20 EST 2011 C:/Users/Seth/Desktop/JAR/RunAppSF.class
  
        [entry was signed on 12/5/11 10:24 AM]
        X.509, CN=Removed Company Name, O=Removed Company Name, L=Removed City, ST=Removed State, C=US
        [certificate is valid from 12/2/11 4:30 PM to 12/2/13 4:30 PM]
        X.509, SERIALNUMBER=00000000, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US
        [certificate is valid from 11/15/06 8:54 PM to 11/15/26 8:54 PM]
        X.509, OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US
        [certificate is valid from 6/29/04 1:06 PM to 6/29/34 1:06 PM]
        [CertPath not validated: null]
  
  
    s = signature was verified 
    m = entry is listed in manifest
    k = at least one certificate was found in keystore
    i = at least one certificate was found in identity scope
  
  jar verified.
  
  Warning: 
  This jar contains entries whose certificate chain is not validated.
  </code></pre>
  
  <p>I also tried the <code>jarsigner -verify</code> command using the same JAR as above on JDK 1.6u26 and 1.6u14 and it came back as being fine.  (Output below from 1.6u26).</p>
  
  <pre><code>         180 Mon Dec 05 10:24:32 EST 2011 META-INF/MANIFEST.MF
           342 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.SF
          6180 Mon Dec 05 10:24:34 EST 2011 META-INF/JAVACSC.RSA
             0 Mon Dec 05 10:24:30 EST 2011 META-INF/
  sm      2161 Wed Nov 30 10:23:20 EST 2011 C:/Users/Seth/Desktop/JAR/RunAppSF.class
  
        [entry was signed on 12/5/11 10:24 AM]
        X.509, CN=Removed Company Name, O=Removed Company Name, L=Removed City, ST=Removed State, C=US
        [certificate is valid from 12/2/11 4:30 PM to 12/2/13 4:30 PM]
        X.509, SERIALNUMBER=00000000, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US
        [certificate is valid from 11/15/06 8:54 PM to 11/15/26 8:54 PM]
        [KeyUsage extension does not support code signing]
        X.509, OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US
        [certificate is valid from 6/29/04 1:06 PM to 6/29/34 1:06 PM]
  
  
    s = signature was verified 
    m = entry is listed in manifest
    k = at least one certificate was found in keystore
    i = at least one certificate was found in identity scope
  
  jar verified.
  </code></pre>
  
  <p>Am I missing an extra step I need to take to get the JAR signed properly for JDK 1.7?</p>