What's the procedure a certificate authority (CA) must follow to get internationally recognized, like Verisign or GlobalSign?
To be intentionally recognized, the trusted certificate authorities (CAs) will need to get their root certificates pre-bundled with specific web browsers and operating systems (OS), like Microsoft Internet Explorer, Apple Safari, Mozilla Firefox, Google Chrome and Opera (et al.). The trusted root certificate list is usually updated periodically to add or remove certificates.
In addition, specific programs like Java or Adobe have their own trusted root CAs which is used in their applications (thanks paj28 for the reminder!). Adobe has a setting which allows all Windows root certificates to be trusted automatically. However, I think the process is not so straightforward in Java.
To be included in Microsoft's Root Certificate Program,
The CA must provide the information requested below, and receive preliminary approval for membership in the Program.
Similarly, Apple's Root Certificate Program requires root certificate authorities to meet certain criteria. This goes on for other browsers.
Other web browsers/OS may have their own specific requirements and legal agreements. Hence, to be as recognized as "internationally" as possible, a CA usually needs to contact all the major OS and web browser developers to obtain permission to be included in each pre-installed list of trusted root CA certificates.
All of the major browser vendors publishes their policies, procedures, requirements, and contact details for root program application in their site.
These links are the policy documents detailing the requirements for some of the major root certificate programs and the primary contact detail required to initiate their process:
- Microsoft: fill in application form and email to email@example.com
- Mozilla: file a formal request in Mozilla's Bugzilla
- Apple: Email to firstname.lastname@example.org
- Google (Android-only): File an issue in Android's Issue Tracker
- Oracle: Email to JAVASE-CA-REQUEST_WW_GRP@ORACLE.COM
- Adobe: Email to adobe representative in America (AATL-NorthAmerica@adobe.com), Europe and Middle East (AATL-EMEA@adobe.com), and the rest of the world (AATL-ROW@adobe.com)
If you are thinking about running an "internationally recognized" CA and you really have to ask this question, then you're probably at least five years away from actually doing so. Being a CA isn't easy, there are lots of auditing reports you need to perform before you even consider applying to root programs and there are reams of documents that you and all your employees need to have detailed knowledge of and another reams of reports that you'll need to prepare to satisfy auditing requirements. Some root programs may not even consider your application unless you already established yourself as a CA with a large customer base.