CA/Browser Forum
Home » All CA/Browser Forum Posts » 2023-03-23 Minutes of the Code Signing Certificate Working Group

2023-03-23 Minutes of the Code Signing Certificate Working Group

Attendees

Atsushi Inaba (GlobalSign), Brianca Martin (Amazon), Bruce Morton (Entrust), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Ian McMillan (Microsoft), Inigo Barreira (Sectigo), Martijn Katerbarg (Sectigo), Roberto Quinones (Intel), Tim Hollebeek (DigiCert)

Minutes

Administration

  • Attendance and requests a minute taker
  • Reads antitrust statement
  • Waiting on minutes for two meeting prior to face to face
  • Face to face minutes will be approved at next meeting

Malware Based Revocation Ballot

  • Ballot summary
  • Taking approach BRs and SBRs are taking on revocation
  • Removing CS specific suspect code reference
  • Discuss 5 day revocation window, consider a 5 day and/or 7 day
  • Bruce noted good to sync with the SSL BRs at 24 hours and 5 days, but ok with suspect code at 5 days and 7 days
  • Discussion if we should have requirements defining a misused certificate compared to private key misuse
  • Additional discussion of misused keys, compared to compromised keys, and signed code that is suspect
  • Action point to consider defining misuse
  • Discussion on proper time limit for known compromise and signing malware
  • Discussion of the difference in timing requirements between key compromise and singing suspect code and back dating revocation
  • Discussed the consideration that signing suspect code should be treated as a potential compromise of key and/or the subscriber does not have practices in place to detect suspect code
  • Discussion of asking Microsoft as the main certificate consumer to weigh in on complicated use cases. This is a practice now and not an overly common practice, this would take place after revocation and there is an open period to back date revocation
  • Mentioned the RFC does not allow back dating, but it is an important tool for code signing
  • Need to cover the loophole for certificate problem reports for expired or revoked certificates
  • Potential wording is being drafted and will be included in GitHub and distributed

Other topics

  • It was determined singing service did not have much to discuss at this time and we should focus on the revocation topic
  • A couple of points on removing the SSL BR reference were mentioned and would be discussed on future calls
Latest releases
Server Certificate Requirements
SC-084: DNS Labeled With ACME Account ID Challenge (#566) - Mar 13, 2025

BRs release version 2.1.4

Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.9 - Ballot SMC011 - May 14, 2025

This ballot allows the option to use a European Unique Identifier (EUID) as a Registration Reference in the NTR Registration Scheme. The EUID uniquely identifies officially-registered organizations, Legal Entities, and branch offices within the European Union or the European Economic Area. The EUID is specified in chapter 9 of the Annex contained in the Implementing Regulation (EU) 2021/1042 which describes rules for the application of Directive (EU) 2017/1132 “relating to certain aspects of company law (codification)”. The ballot also includes several editorial corrections, (e.g., reordering of References and regrouping of information from Appendix A to Section 7.1.4.2.2 (d)). This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Adrian Mueller (SwissSign) and Adriano Santoni (Actalis).

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).