Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8346587

Distrust TLS server certificates anchored by Camerfirma Root CAs

XMLWordPrintable

        TLS server certificates anchored by Camerfirma Root CAs are distrusted or distrusted after a specific date by Google [1], Mozilla [2], Apple [3], and Microsoft [4, 5].

        This enhancement will implement similar restrictions in the JDK.

        The restrictions will be enforced in the SunJSSE Provider of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below and the certificate's notBefore date is after <date TBD>. An application will receive an Exception with a message indicating the trust anchor (root) is not trusted, ex:

           "TLS Server certificate issued after <date TBD> and anchored by a distrusted legacy Camerfirma root CA: CN=Chambers of Commerce Root - 2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see current address at www.camerfirma.com/address), C=EU"

        If necessary, you can work around the restrictions by removing "CAMERFIRMA_TLS" from the "jdk.security.caDistrustPolicies" security property.

        The restrictions will be imposed on the following Camerfirma Root certificates (identified by Distinguished Name) included in the JDK:

        1. CN=Chambers of Commerce Root, OU=http://www.chambersign.org, O=AC Camerfirma SA CIF A82743287, C=EU
        2. CN=Chambers of Commerce Root - 2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see current address at www.camerfirma.com/address), C=EU
        3. CN=Global Chambersign Root - 2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see current address at www.camerfirma.com/address), C=EU

        [1] https://groups.google.com/g/mozilla.dev.security.policy/c/dSeD3dgnpzk/m/iAUwcFioAQAJ
        [2] https://groups.google.com/g/mozilla.dev.security.policy/c/PnAAWnxyosM/m/cImb78jnBAAJ
        [3] https://support.apple.com/en-us/121668
        [4] https://learn.microsoft.com/en-us/security/trusted-root/2023/feb2023
        [5] https://learn.microsoft.com/en-us/security/trusted-root/2024/feb2024

          1.
          		 Release Note: Distrust TLS Server Certificates Anchored by Camerfirma Root Certificates and Issued After April 15, 2025 Sub-task Resolved Mark Powers  

              mpowers Mark Powers
              mullan Sean Mullan
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: