Attendees

Bruce Morton – (Entrust), Corey Bonnell – (DigiCert), Dean Coclin – (DigiCert), Dimitris Zacharopoulos – (HARICA), Ian McMillan – (Microsoft), Inaba Atsushi – (GlobalSign), Inigo Barreira – (Sectigo), Janet Hines – (VikingCloud), Martijn Katerbarg – (Sectigo), Tim Crawford – (CPA Canada/WebTrust)

Minutes

Note Well: The Note Well was read.

Approval of Minutes: April 6th minutes are approved. January 26th minutes are pending. Bruce will take over writing these minutes.

Ballot Status

• CSC-18 – In discussion period. A few additional items were mentioned which are being added:
• Request from Application Software Suppliers to not revoke a certificate when requested by them
• Effective Date. During the call it was discussed to set April 15th 2024 as the effective date, also adding language that will allow CAs to start using the new way earlier.
• A v2 ballot will be started soon
• Incorporating BR references
• No changes since the last meeting. Still need to review and go over definitions
• Signing Service
• No changes here. Also waiting on the other two ballots to complete first

RFC for Key Attestation

Mike from Entrust is trying to put together an RFC around Key Attestation. Information was circulated on the public list for anyone wanting to assist

There was a discussion on TPM 2.0 chips and similar if these are allowed or not. There’s consensus that as long as a device is FIPS 140-2 or 140-3 at the correct level, they are allowed to be used.

This will be clarified in the CSBRs in a future ballot.

Any Other Business

Next F2F is in 6 weeks. Ian mentioned that he plans on requesting a number of Microsoft employees working close with Code Signing to join the CSWG session as well as have some guest speakers during the F2F

Next Meeting

May 4th