CA/Browser Forum
Home » Posts » 2023-03-23 Minutes of the Code Signing Certificate Working Group

2023-03-23 Minutes of the Code Signing Certificate Working Group

Attendees

Atsushi Inaba (GlobalSign), Brianca Martin (Amazon), Bruce Morton (Entrust), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Ian McMillan (Microsoft), Inigo Barreira (Sectigo), Martijn Katerbarg (Sectigo), Roberto Quinones (Intel), Tim Hollebeek (DigiCert)

Minutes

Administration

  • Attendance and requests a minute taker
  • Reads antitrust statement
  • Waiting on minutes for two meeting prior to face to face
  • Face to face minutes will be approved at next meeting

Malware Based Revocation Ballot

  • Ballot summary
  • Taking approach BRs and SBRs are taking on revocation
  • Removing CS specific suspect code reference
  • Discuss 5 day revocation window, consider a 5 day and/or 7 day
  • Bruce noted good to sync with the SSL BRs at 24 hours and 5 days, but ok with suspect code at 5 days and 7 days
  • Discussion if we should have requirements defining a misused certificate compared to private key misuse
  • Additional discussion of misused keys, compared to compromised keys, and signed code that is suspect
  • Action point to consider defining misuse
  • Discussion on proper time limit for known compromise and signing malware
  • Discussion of the difference in timing requirements between key compromise and singing suspect code and back dating revocation
  • Discussed the consideration that signing suspect code should be treated as a potential compromise of key and/or the subscriber does not have practices in place to detect suspect code
  • Discussion of asking Microsoft as the main certificate consumer to weigh in on complicated use cases. This is a practice now and not an overly common practice, this would take place after revocation and there is an open period to back date revocation
  • Mentioned the RFC does not allow back dating, but it is an important tool for code signing
  • Need to cover the loophole for certificate problem reports for expired or revoked certificates
  • Potential wording is being drafted and will be included in GitHub and distributed

Other topics

  • It was determined singing service did not have much to discuss at this time and we should focus on the revocation topic
  • A couple of points on removing the SSL BR reference were mentioned and would be discussed on future calls
Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed

Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.6 - Ballot SMC08 - Aug 29, 2024

This ballot sets a date by which issuance of certificates following the Legacy generation profiles must cease. It also includes the following minor updates:

  • Pins the domain validation procedures to v 2.0.5 of the TLS Baseline Requirements while the ballot activity for multi-perspective validation is concluded, and the SMCWG determines its corresponding course of action;
  • Updates the reference for SmtpUTF8Mailbox from RFC 8398 to RFC 9598; and
  • Small text corrections in the Reference section

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).