在使用IPMI的KVM时提示：
应用程序出于安全原因被阻止
无法验证证书。
将不执行该应用程序。
名称：xxx
发行者：xxx.
位置：http://192.168.x.x:80
按照网上教程在 控制面板——Java——安全——“例外站点”列表中加入了上述IP地址，还是不能运行。推测可能更新了某个版本后才出现这个问题，因为以前在其它电脑上没有这个问题
查询后发现根本原因是应用的证书是SHA256算法。但在证书路径中，有父（根）证书在使用SHA1算法。而新版JAVA把SHA1算法禁止了。
官网也有说明JRE从某个版本开始（大约是2021年的第三季度），默认阻止签名证书使用SHA1算法的应用。但也有例外，就是签名时间戳早于2019年1月1日的，不受此限制。
https://www.oracle.com/java/technologies/javase/11-0-17-relnotes.html
security-libs/java.security
➜ Disabled SHA-1 Signed JARs (JDK-8269039)
JARs signed with SHA-1 algorithms are now restricted by default and treated as if they were unsigned. This applies to the algorithms used to digest, sign, and optionally timestamp the JAR. It also applies to the signature and digest algorithms of the certificates in the certificate chain of the code signer and the Timestamp Authority, and any CRLs or OCSP responses that are used to verify if those certificates have been revoked. These restrictions also apply to signed JCE providers.
To reduce the compatibility risk for JARs that have been previously timestamped, there is one exception to this policy:
Any JAR signed with SHA-1 algorithms and timestamped prior to January 01, 2019 will not be restricted.
This exception may be removed in a future JDK release. To determine if your signed JARs are affected by this change, runjarsigner -verify -verbose -certson the signed JAR, and look for instances of “SHA1” or “SHA-1” and “disabled” and a warning that the JAR will be treated as unsigned in the output.
For example:- Signed by "CN="Signer"" Digest algorithm: SHA-1 (disabled) Signature algorithm: SHA1withRSA (disabled), 2048-bit key WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now disabled by the security property: jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01
JARs affected by these new restrictions should be replaced or re-signed with stronger algorithms.
Users can, at their own risk, remove these restrictions by modifying thejava.securityconfiguration file (or override it by using thejava.security.propertiessystem property) and removing “SHA1 usage SignedJAR & denyAfter 2019-01-01” from thejdk.certpath.disabledAlgorithmssecurity property and “SHA1 denyAfter 2019-01-01” from thejdk.jar.disabledAlgorithmssecurity property.
security-libs/org.ietf.jgss:krb5
解决方法很简单只需要在java.security文件中找到两行带有“denyAfter 2019-01-01”的代码，用#将其注释掉即可