CA/Browser Forum
Home » All CA/Browser Forum Posts » Ballot 162 – Sunset of Exceptions

Ballot 162 – Sunset of Exceptions

Voting on Ballot 162 closed on 16 March 2016. The results are as follows:

  • From the CAs, there were 19 YES votes, 0 NO votes and 5 Abstentions
  • From the Browsers, there were 4 YES votes, 0 NO votes and 0 Abstentions.

Therefore the ballot passes.

Detailed results can be found on the ballot tracker: https://docs.google.com/spreadsheets/d/1FBsMZjlzyvK3mFR1u4qMqvZwlI86yJ-v0am1pCBo8uI/edit#gid=4

Ballot 162 – Sunset of Exceptions

The following motion has been proposed by Ryan Sleevi of Google and endorsed by Richard Barnes of Mozilla and Jeremy Rowley of DigiCert.

-–BEGIN MOTION-–

  1. Modify section 6.1.7 of the Baseline Requirements to add items 5(f) and 5(g) which read:

f. The CA signs the Subscriber Certificate on or before June 30, 2016

g. The notBefore field in the Subscriber Certificate has a date on or before June 30, 2016

  1. Modify section 6.3.2 of the Baseline Requirements to replace the words “Beyond 1 April 2015” with the words “Until 30 June 2016”

  2. Modify Section 5 of Appendix F of the EV Guidelines to remove the last sentence, renumber Section 6 to Section 7, and introduce a new Section 6

“6. When a certificate that includes a Domain Name where .onion is in the right-most label of the Domain Name, the Domain Name shall not be considered an Internal Name if the Certificate was issued in compliance with this Appendix F.”

-–END MOTION-–

To assist in review, a redlined diff view is available at https://github.com/cabforum/documents/compare/master…sleevi:Ballot-162-Draft?expand=1 , with a branch demonstrating the integration of this ballot available at https://github.com/sleevi/cabforum-docs/tree/Ballot-162-Draft

As shown in the diff, certain editorial liberties are taken with respect to informational sections, but they cannot be completed unless and until the ballot is adopted and integrated. The review period for this ballot shall commence at 2200 UTC on 1 March 2016, and will close at 2200 UTC on 8 March 2016. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2200 UTC on 15 March 2016. Votes must be cast by posting an on-list reply to this thread.

A vote in favor of the motion must indicate a clear ‘yes’ in the response. A vote against must indicate a clear ‘no’ in the response. A vote to abstain must indicate a clear ‘abstain’ in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here: /about/members/

In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the votes cast by members in the browser category must be in favor.

Latest releases
Server Certificate Requirements
BRs/2.1.2 SC-080 V3: Sunset the use of WHOIS to identify Domain Contacts and relying DCV Methods - Dec 16, 2024

Ballot SC-080 V3: “Sunset the use of WHOIS to identify Domain Contact… (https://github.com/cabforum/servercert/pull/560) Ballot SC-080 V3: “Sunset the use of WHOIS to identify Domain Contacts and relying DCV Methods” (https://github.com/cabforum/servercert/pull/555)

Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.8 - Ballot SMC010 - Dec 23, 2024

This ballot adopts Multi-Perspective Issuance Corroboration (MPIC) for CAs when conducting Email Domain Control Validation (DCV) and Certification Authority Authorization (CAA) checks for S/MIME Certificates. The Ballot adopts the MPIC implementation consistent with the TLS Baseline Requirements. Acknowledging that some S/MIME CAs with no TLS operations may require additional time to deploy MPIC, the Ballot has a Compliance Date of May 15, 2025. Following that date the implementation timeline described in TLS BR section 3.2.2.9 applies. This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Ashish Dhiman (GlobalSign) and Nicolas Lidzborski (Google).

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).