title: What are the implications of the Symantec CA distrust for code signing certificates?
body: <p>I think I have a good understanding of whats happening with the Symantec CA distrust itself and I also understand the implications Chrome/Firefox users accessing sites via SSL, but will the distrust impact code signing, specifically in Java?  I'm attempting to determine if I must re-sign and re-issue JAR files to all of our customers.  The application in question is a JAR file which is part of a legacy <em>Oracle Forms</em> application.</p>
  
  <p><strong>Code-signing Certificate details</strong> </p>
  
  <p><em>Root</em>  </p>
  
  <pre><code>CN=VeriSign Class 3 Public Primary Certification Authority - G5
  OU=(c) 2006 VeriSign\, Inc. - For authorized use only,
  OU=VeriSign Trust Network,
  O=VeriSign\, Inc.,
  C=US
  </code></pre>
  
  <p><em>Intermediate</em>  </p>
  
  <pre><code>CN=Symantec Class 3 SHA256 Code Signing CA,
  OU=Symantec Trust Network,
  O=Symantec Corporation,
  C=US
  </code></pre>
  
  <p><em>Specific Questions</em>  </p>
  
  <ol>
  <li><p>Are certs from the aforementioned intermediate/root CA affected by the distrust? </p></li>
  <li><p>Is it true that Java's CA blacklist would have to be manually updated for this to affect an installation of Java that preexisted the distrust decision?</p></li>
  <li><p>Is Java going to update their blacklist to include the Symantec CA's which Chrome/Firefox are distrusting in future releases of Java?  I can't find any mention of this one way or the other.</p></li>
  </ol>