Including Certificate Authority Root Certificates in Java

Program Requirements

The Oracle Java Root Certificate program is in a steady state and generally not accepting new participants. Only widely recognized Certificate Authorities with a significant customer base and global reach should consider applying.

In order to protect Oracle's Java SE customers from security issues related to the use of public key infrastructure (PKI) certificates while enhancing their overall experience, Oracle requires that all root certificates authorities meet the following criteria before applying for inclusion of their root certificates in Oracle’s Java Runtime Environment (JRE).

• Certificate Authorities (CA) providers must maintain a WebTrust Certification for Certificate Authorities or an equivalent independent third-party certification. For certifications from a different program the burden is on the CA to prove equivalency to the WebTrust for CAs program.
• Companies and organizations (public or private) who are not well known and globally recognized Certificate Authorities with a global reach are unlikely to be accepted.
• Root certificates that have an expiration date in the next 5 years might not be considered.
• A maximum of three root certificates per CA will be accepted to minimize the impact on performance and installation time.
• A test certificate issued from each CA provider’s root to be assessed for inclusion must be made available to Oracle along with the application.
• Only applications from well-established and widely used CAs will be accepted.
• The root certificate must be of value to the broader Java community. For example, root certificates that are only available to internal developers, customers of a single organization, or closed network of organizations are not acceptable for the Root Certificate Program.
• Certificates issued from the root certificates must support the CRL distribution point extension or OCSP, preferably both. The CRL distribution point must point to a publicly accessible location.
• Root certificates and certificates issued by the root CA or any subordinate CA must conform to the RFC 5280 standard.
• All documents written in languages other than English must be accompanied by a certified translation.

Use of your root certificates: If accepted into the program Oracle will have the right, but not the obligation to, distribute your root certificates in our Java Runtime Environment’s (JRE) root certificate store.

Application process

The process starts with a globally recognized Certificate Authority with broad and international customer base, and/or existing program participant sending e-mail with the following information to JAVASE-CA-REQUEST_WW_GRP

• Contact information for two members of your organization: First Name, Last Name, Title, email Address and phone numbers.
• Company name and address
• Backup/Alternate contact name and address, preferably a durable contact that can survive employee turnover (eg, "legal@companynameDOTcom")
• Company web page address (URL)
• Link to a Certificate Practice Statement
• List of all current third-party audits your CA practice has passed
• Copy of your Audit Report
• Certificate revocation server URL (CRL and OCSP)
• Explanation of how your organization reports revocation status for expired code signing certificates. Explanation should include if expired certificates are pruned from CRLs/OCSPResponses as soon as they expire. If not, how long is revocation information maintained for expired certificates. Note: if not indefinite, we may decline new participants that do not retain expired information for an extended period of time.
• Number of roots you would like to submit
• List of other programs on which your root certificates are already included
• List of other programs on which your root certificates that you are applying for are already included
• Attach or link test certificate issued from each root to be assessed for inclusion
• Answers to the following questions
  • What business purpose and applications (ex: code signing, SSL Client SSL Server, S/MIME, etc) will certificates issued from these root certificates serve?
  • Who will obtain certificates from your Certificate Authority and what are the processes used for doing so?
    • Will you issue certificates to individuals, organizations, or both?
    • Do you only issue certificates to users from a specific region, language, demographic or other niche demographic?
    • How do you market your organization, and more specifically, how do users request a certificate from you (please be specific for each of individuals and organizations if different)?
  • What is the validation process for someone requesting a certificate issued from these roots?
• A copy of the root(s) to be evaluated can be included in the e-mail for initial examination.

You should receive an email receipt confirmation within 20 business days of submitting your request.

We will then evaluate your request and contact you if appropriate for additional information.

The evaluation period will vary in length depending on the individual characteristics of the request and might require additional information. Please note that even for perfectly qualified applications the entire process can take several months.

Submissions of applicants that do not reply to Oracle’s request for information will be placed on hold until all questions are answered. Applications that have been placed on hold for more than 3 months will be considered abandoned and a new application will be required to restart the process.