CA/Browser Forum
Home » All CA/Browser Forum Posts » Ballot 22 – RSA 1024 Retirement

Ballot 22 – RSA 1024 Retirement

Ballot 22 – RSA 1024 Retirement (Unanimously Passed)

Motion

Robin Alden made the following motion, and Steve Medin and Moudrick Dadashov endorsed it.

Motion begins

The Guidelines should be amended in accordance with the following erratum.

Erratum begins

Delete Appendix A and replace it with the following.

Appendix A Minimum Cryptographic Algorithm and Key Sizes

  1. Root CA Certificates
Root Certificates whose validity period begins on or before 31 Dec 2010Root Certificates whose validity period begins after 31 Dec 2010
Digest algorithmMD5 (NOT RECOMMENDED),SHA-1SHA-1*, SHA-256, SHA-384 or SHA-512
RSA2048†2048
ECCNIST P-256NIST P-256
  1. Subordinate CA Certificates
Subordinate CA Certificates whose validity period begins on or before 31 Dec 2010Subordinate CA Certificates whose validity period begins after 31 Dec 2010
Digest algorithmSHA-1SHA-1*, SHA-256, SHA-384 or SHA-512
RSA10242048
ECCNIST P-256NIST P-256
  1. Subscriber Certificates
Subscriber Certificates whose validity period ends on or before 31 Dec 2010Subscriber Certificates whose validity period ends after 31 Dec 2010
Digest algorithmSHA-1SHA1*, SHA-256, SHA-384 or SHA-512
RSA10242048
ECCNIST P-256NIST P-256

† A Subscriber Certificate may, in addition, chain to an EV-enabled <2048-bit key RSA root CA certificate.

  • SHA-1 SHOULD be used only until SHA-256 is supported widely by browsers used by a substantial portion of relying parties worldwide.

Erratum ends

Motion ends

The ballot review period comes into effect at 18.00 EST on Monday 15th December, and will close at 18.00 EST on Monday 22nd December. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 18.00 EST on Monday 29th December.

Votes must be cast by ‘reply all’ to this email.

A vote in favour of the motion must indicate a clear ‘yes’ in the response. A vote against must indicate a clear ‘no’ in the response. A vote to abstain must indicate a clear ‘abstain’ in the response. Unclear responses will not be counted.

The latest vote received from any representative of a voting member before the close of the voting period will be counted.

Latest releases
Server Certificate Requirements
SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods - May 21, 2025

BR v2.1.5

Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.9 - Ballot SMC011 - May 14, 2025

This ballot allows the option to use a European Unique Identifier (EUID) as a Registration Reference in the NTR Registration Scheme. The EUID uniquely identifies officially-registered organizations, Legal Entities, and branch offices within the European Union or the European Economic Area. The EUID is specified in chapter 9 of the Annex contained in the Implementing Regulation (EU) 2021/1042 which describes rules for the application of Directive (EU) 2017/1132 “relating to certain aspects of company law (codification)”. The ballot also includes several editorial corrections, (e.g., reordering of References and regrouping of information from Appendix A to Section 7.1.4.2.2 (d)). This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Adrian Mueller (SwissSign) and Adriano Santoni (Actalis).

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).