Ballot SC50: Remove the requirements of section 4.1.1

Voting Results

Certificate Issuers

24 votes total, with no abstentions:

• 24 Yes votes: Amazon, Certigna (DHIMYOTIS), Chunghwa Telecom, D-TRUST, DigiCert, Disig, eMudhra, Entrust, Firmaprofesional, GDCA, GlobalSign, GoDaddy, HARICA, Izenpe, JPRS, Kamu SM, Let’s Encrypt / ISRG, OISTE, Sectigo, SSL.com, SwissSign, Telia Company, TrustCor, Visa
• 0 No Votes
• 0 Abstentions

Certificate Consumers

5 votes total, with no abstentions:

• 5 Yes votes: Apple, Cisco, Google, Mozilla, 360
• 0 No Votes
• 0 Abstentions

Bylaw Requirements

1. Bylaw 2.3(f) requires:

• A “yes” vote by two-thirds of Certificate Issuer votes and by 50%-plus-one of Certificate Consumer votes. Votes to abstain are not counted for this purpose. This requirement was MET for Certificate Issuers and MET for Certificate Consumers.
• At least one Certificate Issuer and one Certificate Consumer Member must vote in favor of a ballot for the ballot to be adopted. This requirement was MET.

2. Bylaw 2.3(g) requires that a ballot result only be considered valid when “more than half of the number of currently active Members has participated”. Votes to abstain are counted in determining quorum. Half of the currently active members at the start of voting was 14, so the quorum was 15 for this ballot. This requirement was MET.

Ballot Contents

PURPOSE OF BALLOT

When attempting to reduce the retention period required for audit logs and data archives, the NetSec Subcommittee also identified gaps in which data a CA is required to retain which make it somewhat difficult to make the desired adjustments to retention period. Specifically, a CA is currently required to retain, but not use, data as defined in 4.1.1 of the BRs. While reviewing the intent, purpose, and real-world usage around section 4.1.1, it became apparent that there’s little value in requiring CAs to maintain a database for which there is no prescribed purpose or required action. This ballot seeks to address this gap by replacing section 4.1.1 with “No stipulation.” as is appropriate based on current expectations here.

The following motion has been proposed by Clint Wilson of Apple and endorsed by Trevoli Ponds-White of Amazon and Dustin Hollenback of Microsoft.

Motion begins

This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates” as defined in the following redline, based on Version 1.8.0:

https://github.com/cabforum/servercert/compare/cda0f92ee70121fd5d692685b97ebb6669c74fb7..8b2681c3f93bbc9fbe83ab9d67999629db630e94

Motion ends

This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:

Discussion (7+ days)

Start Time: October 28 16:00 UTC End Time: November 4 16:00 UTC

Vote for approval (7 days)

Start Time: November 11 17:00 UTC End Time: November 18 17:00 UTC

Ballot Status

This Ballot entered the IP Rights Review period on 22 November 2021 and exited review on 23 December 2021. No IP Rights exclusions were filed during the review period. The ballot is effective as of 23 December 2021, and has been published as Baseline Requirements version 1.8.1.