ZoTrus Trusted Root ProgramEffective Date: April 20, 2022, Last Updated: August 21, 2026

• Service Relevance: The CA must provide valuable certificate services to end users of ZoTrus products. Root certificates must deliver broad value to users of ZoTrus products.
• Compliance: The CA must strictly adhere to all requirements of this program and ensure that the certificates it issues comply with relevant international standards (such as CA/Browser Forum Baseline Requirements) or relevant Chinese cryptography industry standards.
• Audit Requirements: The CA's root certificates and all intermediate certificates capable of issuing end-entity certificates must undergo an independent, qualified audit at least annually (see Section 3 for specific requirements).
• Transparency and Disclosure: The CA must strictly comply with its Certificate Policy (CP) and/or Certification Practice Statement (CPS) documents. If the CA anticipates any change in control or ownership of any CA certificate (whether a root certificate or an intermediate certificate), it must notify ZoTrus in advance. Trust in a root certificate is non-transferable.
• Incident Response: The CA must establish and maintain an effective incident response and certificate revocation plan.
• Prerequisite for Application: CAs applying to join the ZoTrus Trusted Root Certificate Program must satisfy all program and policy requirements prior to submitting their application.

3.1 Requirements for CAs Using RSA/ECC Algorithms

3.1.1 Audit Requirements:

• The root CAs and all intermediate CAs capable of issuing SSL/TLS certificates must be audited at least annually against at least one of the following standards:
  ✦ WebTrust Principles and Criteria for Certification Authorities — SSL Baseline and Network Security (preferred)
  ✦ ETSI EN 319 411-1 LCP and (DVCP or OVCP)
• The root CAs and all intermediate CAs capable of issuing EV SSL/TLS certificates must be audited at least annually against at least one of the following standards:
  ✦ WebTrust Principles and Criteria for Certification Authorities, WebTrust Principles and Criteria — SSL Baseline and Network Security, and WebTrust Principles and Criteria — Extended Validation SSL (preferred)
  ✦ ETSI EN 319 411-1 NCP and EVCP

3.4 Document Signing Certificate Requirements

Given that the CA/Browser Forum has not yet published Baseline Requirements for document signing certificates, CAs applying for root trust for PDF document digital signatures and timestamps must have their root certificates already trusted in the Adobe AATL. PDF signing certificates should comply with the ISO 32000 series of standards and be identified through the Extended Key Usage id kp documentSigning (OID: 1.3.6.1.5.5.7.3.36).

To enable rapid identification of certificate types and allow ZT Browser and ZTmail to correctly display the certificate validation level as T1 / T2 / T3 / T4, CAs must declare one of the following policy OIDs in the Certificate Policies extension of end user PDF document signing certificates. Otherwise, the certificate will default to T1 display:

3.5 Intranet SSL Certificate Requirements

Given that international standards do not permit CAs to issue public SSL certificates containing internal names or reserved IP addresses — as such names and IP addresses cannot be validated according to relevant validation standards — intranet environments still require SSL certificates to enable HTTPS encryption and protect the confidentiality of internal web systems. ZT Browser has therefore established the following CA requirements for intranet SSL certificates.

• An intranet SSL certificate is defined as an SSL certificate whose Subject Alternative Name (SAN) field contains internal names and/or reserved IP addresses. Reserved IP addresses follow the definitions of IANA (IP V4 and IP V6). Internal names refer to non public domain names.
• CAs issuing intranet SSL certificates may submit dedicated root CA certificates used solely for issuing intranet SSL certificates for application to the ZoTrus Trusted Root Program. CAs must not issue intranet SSL certificates from root certificates used to issue publicly trusted SSL certificates.
• The Subject field of an intranet SSL certificate must be a public Fully Qualified Domain Name (FQDN) and must not contain internal names or reserved IP addresses. This public domain name is used by the CA to validate ownership of the intranet SSL certificate. The CA must complete domain control validation in accordance with Section 3.2.2.4 or Section 3.2.2.5 of the TLS BR.
• The Subject Alternative Name (SAN) field of an intranet SSL certificate must contain at least one internal name or reserved IP address, and internal names or reserved IP addresses may only be included in the SAN field. The CA is not required to validate these internal names or reserved IP addresses. However, the CA must validate all public domain names and public IP addresses included in the SAN field in accordance with relevant standards.
• The validity period of an intranet SSL certificate may range from 1 to 5 years.
• To enable rapid identification of intranet SSL certificate types and allow ZT Browser to correctly display the certificate authentication level as T1/T2/T3/T4, CAs must declare one of the following policy OIDs in the Certificate Policies extension of their TLS/SSL certificates. Otherwise, the certificate will default to T1 display:
  
  ✦ Intranet DV SSL Certificate: 1.2.156.157933.81 or 1.3.6.1.4.1.57933.81
  ✦ Intranet IV SSL Certificate: 1.2.156.157933.82 or 1.3.6.1.4.1.57933.82
  ✦ Intranet OV SSL Certificate: 1.2.156.157933.83 or 1.3.6.1.4.1.57933.83
  ✦ Intranet EV SSL Certificate: 1.2.156.157933.84 or 1.3.6.1.4.1.57933.84
• Inclusion of the OIDs specified in (6) in an intranet SSL certificate indicates that the CA issued intranet SSL certificate satisfies requirements (1) through (5) above. Certificates that do not meet these requirements will be displayed as "Not Secure" in ZT Browser.
• Other requirements for intranet SSL certificates are the same as those for public SSL certificates under relevant industry standards.
• These requirements apply to both RSA/ECC algorithm and SM2 algorithm intranet SSL certificates.

3.6 Root Certificate Compliance Declaration

By joining the ZoTrus Trusted Root Program, a CA automatically commits that all end entity certificates issued under its included root CA certificates — including but not limited to SSL/TLS certificates, S/MIME email certificates, PDF document signing certificates, code signing certificates, intranet SSL certificates, and electronic invoice signing certificates — strictly comply with the corresponding OID policies and ZoTrus product specific requirements set forth in Section 3 of this program.

• Root Certificate Validity Period: Newly applied root certificates must have a validity period of no less than 8 years and no more than 25 years from the date of submission.
• Certificate Revocation: CAs must maintain publicly available Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) services and ensure they are updated in a timely manner.
• Certificate Renewal and Update: CAs should submit renewal applications in a timely manner before root certificate expiration to ensure service continuity.

• Submit Application: Qualified CAs should complete the application form (Download) and send it to the designated email address:
• Preliminary Review: ZoTrus Technology will conduct a completeness review of the application materials.
• Technical Assessment and Testing: CAs that pass the preliminary review will proceed to the technical assessment and compatibility testing phase.
• Final Approval and Embedding: Upon passing all assessments, the CA's root certificate will be included in the trust store of ZoTrus products and pushed to users in the next product update.