They need to meet the same criteria we do, here are some starting points but its far from exaustive:

http://www.mozilla.org/projects/security/certs/policy/

http://social.technet.microsoft.com/wiki/contents/articles/3...

http://www.webtrust.org/homepage-documents/item27839.aspx