CA/Browser Forum
Home » All CA/Browser Forum Posts » 2022-08-16 Minutes of the Network Security Working Group

2022-08-16 Minutes of the Network Security Working Group

CA/Browser Forum NetSec Meeting

Attendance: Adam Jones – Microsoft Aaron Poulsen – Amazon Trust Services Ben Wilson – Mozilla Bruce Morton – entrust Clint Wilson – Apple Corey Bonnell – DigiCert Corey Rasmussen – OATI Daryn Wright – Go Daddy Dustin Hollenback – Microsoft Joanna Fox – TrustCor Kiran Tummala – Microsoft Rebecca Kelley – Apple Ruben Annemans – GlobalSign Tim Crawford – BDO Tobias Josefowitz – Opera Trevoli Ponds – Amazon Trust Services Wendy Brown – FPKI

Minutes:

  1. Read Antitrust Statement a. Clint Wilson read the antitrust statement
  2. Roll Call a. No new members in attendance
  3. Review Agenda a. Approved minutes from previous meetings b. Meta Update (Clint Wilson) c. Update on Air-Gapped Systems Ballot (Ben Wilson) d. Open for other business
  4. Meta Update a. Moving and closing out previous backlog in the server working group to a repository in GitHub over the next few weeks.
  5. Update on Air Gap Systems Ballot
  • Reviewed and discussed all multiple aspects of section 5 i. Questions and commentary focused on what the review encompasses and what is the expected outcome. Looking for more details. ii. Language and terms need to be updated/changed due to over-specification on configuration iii. Find a location for Network Security guidelines or requirements within document, as it doesn’t fit into this section well. Iv. Discussed Patch Management in relation to this ballot v. Discussed Certificate Management in relation to this ballot
  • Possible goal of changes summarized by Clint Wilson: “For a CA to successfully and Ideally, in a timely manner, detect an unexpected change occurred to the area of any part of the Air-gapped Systems.”
  • Reviewed System Designs section and discussed vulnerabilities language in Section 4.
  1. Other Business a. Possibly schedule additional meeting to go more in-depth into language and understanding of the Air Gapped Systems Ballot. b. Corey Rasmussen asked if the group had address how the updated versions (ie; OpenSSL) even get on the air-gapped systems? (Marked as a follow up question and will be placed on next agenda topics in regards to this ballot)
Latest releases
Server Certificate Requirements
SC-084: DNS Labeled With ACME Account ID Challenge (#566) - Mar 13, 2025

BRs release version 2.1.4

Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.9 - Ballot SMC011 - May 14, 2025

This ballot allows the option to use a European Unique Identifier (EUID) as a Registration Reference in the NTR Registration Scheme. The EUID uniquely identifies officially-registered organizations, Legal Entities, and branch offices within the European Union or the European Economic Area. The EUID is specified in chapter 9 of the Annex contained in the Implementing Regulation (EU) 2021/1042 which describes rules for the application of Directive (EU) 2017/1132 “relating to certain aspects of company law (codification)”. The ballot also includes several editorial corrections, (e.g., reordering of References and regrouping of information from Appendix A to Section 7.1.4.2.2 (d)). This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Adrian Mueller (SwissSign) and Adriano Santoni (Actalis).

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).