Code signing and Timestamp Server Error

Question

Warning: I’ve got exactly 2 days experience with AIR
but a client wants to add file IO capabilites to a
touchscreen/Flash application we developed and AIR seems to be our
only choice.
From CS4 I can publish an AIR 1.5 application with a self
signed code certificate but I get the error “Could not
connect to timestamp server”, I can then disable the
timestamp and get the warning: “If the AIR application is not
timestamped, it will fail to install when the digital certificate
expires. Are you sure you want to disable timestamping?” I
can proceed without the timestamp and everything seems to work.
So I’m wondering, when does my certificate expire? I
think I might have read 5 years. What do my clients do if they have
to reinstall the application after 5 years? Make them pay for
another copy ;-) Lastly, how do I avoid the timestamp error? Sign
up with a CA like VeriSign at $500/yr, not gonna happen for just
one client.
Sorry to sound a little testy but I could have written
exactly the same application in Director and not had to worry about
this code signing business.

Answer 1

You need to have a network connection for timestamping to
work. If that network connection uses a proxy server, you may also
need to set up the JRE to use that proxy (See
http://www.java.com/en/download/help/5000020600.xml).
When the certificate expires, the AIR file can't be used
anymore if there is no timestamp.
A timestamp verifies that the certificate was valid when the
AIR file was signed, so the AIR app can be installed even after the
cert expires when a timestamp is present.
Timestamps do not require a Verisign, or any other commercial
certificate. The service is free.