There are a number of other providers (such as StartSSL) that are widely trusted, but are NOT included in the JDK/JRE default trust store, so any java based client will not trust the certificates out of the box. Do you know if the CA you’ll be cross signing with is included in the java default trus…

Confirmed NOT working with Oracle Java SE Runtime Environment (build 1.8.0_60-b27). Here is a simple java app using standard java methods to test a web request against https://helloworld.letsencrypt.org https://gist.github.com/Firefishy/b2e606c42edcc4f513ba URLConnectionReader.java // Base…

Is it planned to apply to Oracle Java Root Certificate program ? Not being recognized by the JDK is a no-go for us.

@don-vip , I believe we can apply to it but it presumably won’t be retroactive: all clients will need to update to newer Java releases in order to accept the new root certificate list, unlike Microsoft’s on-the-fly distribution of roots to clients, for example.

You’re absolutely right. Only new versions of JDK provide updates to this list. In fact updates are not frequent. The last one occured recently with JDK 8u51 . In our case that would not be a problem as we tell to all of our users to use recent versions of Java, but that could be problematic for othe…

Yeah, only way to do it would be to get another cross signature that is in the trust list.

Thanks a lot! In case of you would also consider @nneul ’s suggestion to get another cross signature that is in the current trust list, I just have extracted it from latest version of Java (8u66) with this small program . The list contains 93 entries: 1: CN=AAA Certificate Services, O=Comodo CA Limit…

[image] schoen: unlike Microsoft's on-the-fly distribution of roots to clients, for example. Ah, yes that thing... :fearful: You talk about as if it is such nice ...

@don-vip , our director told me that ISRG has already applied to the Oracle root program, so hopefully our application will be accepted and future versions of Java will trust our certificates.

I’ve just hit this issue my self. Whilst beta testing I found maven wouldn’t accept the cert (I have proxied Nexus on a whitelisted domain) & maven was failing with: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: una…

Will the cross root cover trust by the default list in the JDK/JRE?

Issuance Tech

schoen October 23, 2015, 6:38pm 9

@don-vip, I will ask at ISRG to see if we can apply to the Oracle root program or if we’ve already done so.

Topic		Replies	Views
Helloworld.letsencrypt.org can only find certificate with DST X3 loaded Server	19	9588	June 12, 2016
Certificate upgrade Java Tomcat (and Apache) Server	16	2939	May 13, 2019
DST Root CA X3 based cert no longer accepted by Java 8u144 Help	18	2012	March 25, 2021
Which browsers and operating systems support Let's Encrypt Server	70	210640	November 19, 2020
CN=DST Root CA X3, O=Digital Signature Trust Co. and serial number 4001 7721 37D4 E942 B8EE 76AA 3C64 0AB7 is not a trusted certificate Help	33	8257	November 19, 2021

Will the cross root cover trust by the default list in the JDK/JRE?

Related topics