CA/Browser Forum
Home » All CA/Browser Forum Posts » Ballot 7 – Parent Subsidiary

Ballot 7 – Parent Subsidiary

Ballot 7 – Parent Subsidiary (Passed Unanimously)

Motion

Tony Berman has made the following motion, and Peri Drucker and Bruce Morton have endorsed it:

Motion begins

The Guidelines should be amended by the following erratum.

Erratum begins

Section 16 (a) (1)

Add: “or a Parent/Subsidiary Company”.

The revised section shall read:

“(a) Address of Applicant’s Place of Business

(1) Verification Requirements To verify Applicant’s physical existence and

business presence, the CA MUST verify that the physical address provided by

Applicant is an address where Applicant or a Parent/Subsidiary Company conducts business operations (e.g., not a mail drop or P.O. box), and is the address of Applicant’s Place of Business.”

Section 16 (a) (2) (A) (1)

Add: “or a Parent/Subsidiary Company“.

The revised section now reads:

(2) Acceptable Methods of Verification To verify the address of Applicant’s

Place of Business:

(A) For Applicants whose Place of Business is in the same country as

Applicant’s Jurisdiction of Incorporation or Registration:

(1) For Applicants listed at the same Place of Business address in the

current version of either at least one (1) Qualified Independent

Information Source or a Qualified Governmental Tax Information

Source, the CA MUST confirm that Applicant’s address as listed in the

EV Certificate Request is a valid business address for Applicant or a Parent/Subsidiary Company by reference to such Qualified Independent Information Sources or a Qualified Governmental Tax Information Source, and MAY rely on Applicant’s representation that such address is its Place of Business;

Section 16 (a) (2) (A) (2)

Add: “or a Parent/Subsidiary Company’s”.

The revised section shall read:

“For Applicants who are not listed at the same Place of Business address in the current version of either at least one (1) Qualified Independent Information Source or a Qualified Governmental Tax Information Source, the CA MUST confirm that the address provided by Applicant in the EV Certificate Request is in fact Applicant’s or a Parent/Subsidiary Company’s business address, by obtaining documentation of a site visit to the business address which MUST be performed by a reliable individual or firm. The documentation of the site visit MUST:

(a) Verify that Applicant’s business is located at the exact address stated in the EV Certificate Request (e.g., via permanent signage, employee confirmation, etc.);

(b) Identify the type of facility (e.g., office in a commercial building, private residence, storefront, etc.) and whether it appears to be a permanent business location;

(c) Indicate whether there is a permanent sign (that cannot be moved) that identifies Applicant;

(d) Indicate whether there is evidence that Applicant is conducting ongoing business activities at the site (e.g., that it is not just a mail drop, P.O. box, etc.); and

(e) Include one or more photos of (i) the exterior of the site (showing signage indicating Applicant’s name, if present, and showing the street address if possible), and (ii) the interior reception area or workspace.

Section 16 (a) (2) (A) (3)

Add: “or a Parent/Subsidiary Company”.

The revised section shall read:

“(3) For all Applicants, the CA MAY alternatively rely on a Verified Legal

Opinion or a Verified Accountant Letter that indicates the address of

Applicant’s or a Parent/Subsidiary Company’s Place of Business and that business operations are conducted there.”

Definitions

Delete “Wholly owns” add “owns a majority of”.

  1. Parent Company: A parent company is defined as a company that owns a majority of the Subsidiary Company and this can be verified by referencing a QIIS or from financial statement supplied by a registered Chartered Professional Accountant (CPA) or equivalent outside of the USA.

  2. Subsidiary Company:

Delete “Wholly owned” add “majority owned”.

The new definition shall read:

“A subsidiary company is defined as a company that is majority owned by Applicant as verified by referencing a QIIS or from financial statement supplied by a registered Chartered Professional Accountant (CPA) or equivalent outside of the USA.”

Erratum ends

Motion ends

Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.7 - Ballot SMC09 - Nov 25, 2024

This ballot includes updates for the following: • Require pre-linting of leaf end entity Certificates starting September 15, 2025 • Require WebTrust for Network Security for audits starting after April 1, 2025 • Clarify that multiple certificatePolicy OIDs are allowed in end entity certificates • Clarify use of organizationIdentifer references • Update of Appendix A.2 Natural Person Identifiers This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Clint Wilson (Apple) and Martijn Katerbarg (Sectigo).

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).