Enable Java to permit expired certificate
<p>Is there any command line flag(s) to enable Java to permit expired certificates?</p>

<p>Right now I'm getting the following exception as the Certificate is expired.</p>

<pre><code>Caused by: java.security.cert.CertificateExpiredException: NotAfter: {PAST DATETIME}
at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:274)
at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:629)
at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:602)
at org.apache.ws.security.validate.SignatureTrustValidator.validateCertificates(SignatureTrustValidator.java:103)
</code></pre>

<p>I've tried the following command line flag which doesn't ignore Certificate Expiration check</p>

<pre><code>-Dcom.sun.net.ssl.checkRevocation=false
</code></pre>

<p>Our application is running in tomcat under path <code>/myapplication</code>. So I created another application <code>/ignorecertificate</code> and deployed in same Tomcat's webapp folder. As per the accepted answer in this <a href="https://stackoverflow.com/questions/1201048/allowing-java-to-use-an-untrusted-certificate-for-ssl-https-connection">question</a>, I run the following code in startup of <code>/ignoreexpired</code> application.</p>

<pre><code>// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
            return null;
        }
        public void checkClientTrusted(
            java.security.cert.X509Certificate[] certs, String authType) {
        }
        public void checkServerTrusted(
            java.security.cert.X509Certificate[] certs, String authType) {
        }
    }
};

// Install the all-trusting trust manager
try {
    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new java.security.SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
    e.printStackTrace();
}
</code></pre>

<p>Since both applications were deployed in same tomcat, I expected <code>/myapplication</code> to ignore certificate expiration check / exception (Bcoz both applications share the same java instance). But still it's not working. I run this ignore code in another application(<code>/ignoreexpired</code>) coz I don't want to make any changes in my current application(<code>/myapplication</code>).</p>