We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA roots as well in any JVM updates? Was there any indication of such move?

Oracle page https://java.com/en/jre-jdk-cryptoroadmap.html mention only TLS server certificates being distrusted. Does this mean that JARs signed by certificates rooted in one of the affected CAs are still OK to be used?


According to Oracle JRE and JDK Cryptographic Roadmap Symantec Root CAs will be removed in April 2019 release:

Date: 2019-04-16
Releases: 12, 11, 8, 7
Action: Distrust TLS server certificates anchored by Symantec Root CAs. 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.