code signing cert expired?

why would I have to change the code base for the jogl library when the version that we linked to on your site before the security change has the exact same codebase?

and I'm referring to https://jogamp.org/deployment/archive/rc/v2.2.4/jar/jogl-all.jar

At first, I advise you to look at the Oracle documentation. It's not a joke, Java Webstart has become increasingly painful to use, it's difficult to understand all "security" changes:
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/security/manifest.html#codebase

Secondly, I'm still waiting for a reply concerning the renewal. As far as I know, only the very latest released version will be signed anew as a first step, I can't give any guarantee on other versions but as you need JOGL 2.2.4 to be signed with a valid "trusted" certificate, I'll communicate this information, we'll do our best.

You should look at this:
https://jogamp.org/bugzilla/show_bug.cgi?id=1293#c4

:)

I wonder if the Lets Encrypt certificates can be used for code-signing. Might be worth a try.

It's worth a try:
https://maximilian-boehm.com/hp2121/Create-a-Java-Keystore-JKS-from-Let-s-Encrypt-Certificates.htm

Oops:
https://community.letsencrypt.org/t/is-it-possible-to-use-le-to-sign-java-applets/6175