2022-01-06 Minutes of the CA/Browser Forum Teleconference

Attendees

Adam Jones (Microsoft), Adrian Mueller (SwissSign), Andrea Holland (SecureTrust), Ben Wilson (Mozilla), Bruce Morton (Entrust), Chris Kemmerer (SSL.com), Clint Wilson (Apple), Corey Bonnell (Digicert), Dean Coclin (Digicert), Dimitris Zacharopoulos (HARICA), Doug Beattie (GlobalSign), Dustin Hollenback (Microsoft), Enrico Entschew (D-TRUST), Fumihiko Yoneda (Japan Registry Services), Hazhar Ismail (MSC Trustgate Sdn Bhd), Inaba Atsushi (GlobalSign), Israr Ahmed (E-tugra), Joanna Fox (TrustCor Systems), Johnny Reading (GoDaddy), Jos Purvis (Cisco Systems), Karina Sirota (Microsoft), Kati Davids (GoDaddy), Mads Henriksveen (Buypass AS), Marcelo Silva (Visa), Martijn Katerbarg (Sectigo), Niko Carpenter (SecureTrust), Peter Miskovic (Disig), Rae Ann Gonzales (GoDaddy), Rebecca Kelley (Apple), Ryan Dickson (Google), Stephen Davidson (Digicert), Tadahiko Ito (SECOM Trust Systems), Tim Hollebeek (Digicert), Trevoli Ponds-White (Amazon), Tyler Myers (GoDaddy), Vijayakumar (Vijay) Manjunatha (eMudhra), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Yoshiro Yoneya (Japan Registry Services)

Minutes

• Opening Procedures- Dean

• Roll Call

• Read Antitrust Statement

• Review Agenda

• Approval of minutes of last call

• Face to Face minutes approved

• Forum Infrastructure Subcommittee update given by Jos Purvis

• No update due to no meetings since last meeting

• Code Signing Certificate Working Group update given by Bruce Morton

• Working on ballot for subscriber key protection

• Making progress on changing format for CSBRs

• Taking about verification for open source projects- how to issue CS certificates to open source projects or members of OS projects

• Changing the validity period for timestamp authorities certificates and rekey requirements

• SMIME working group update given by Stephen Davidson

• Talking about actual verification regimes covering 3 areas:

• The organization

• Control over the domain or mailbox

• The individual identity

• Discussion about OV and EV for S/MIME certificates and how to verify the legal existence of entities in both cases, but especially EV

• Tried to adopt standards that have come out of the baseline requirements

• Discussions of where there are deviations from the baseline requirements

• Example, there are some stipulations of subscriber keys that are specific to TLS but don’t really apply to S/MIME

• Question: When will you have draft BRs out?

• 2022 is the intent

• F2F dates

• June meeting- RSA conference was postponed until June meeting with Certum. Polled of 39 participants on call, 1 has said they may be attending. No additional comments.

• Unclear what the status of this meeting is at this time.

• The reason for doing it is due to a forum that will be held at the same time at that location and thought that Forum participants will want to stay and listen for it.

• Similar case for Berlin, where Face to Face is scheduled at the same time as CA Day

• People who are going to Salt Lake City should review the registration page modify the additional columns that were added.

• Any Other Business:

• None

• Next call: January 20th, 2022