CA/Browser Forum
Home » All CA/Browser Forum Posts » 2023-06-29 Minutes of the Code Signing Certificate Working Group

2023-06-29 Minutes of the Code Signing Certificate Working Group

Attendees

Andrea Holland (VikingCloud), Atsushi INABA (GlobalSign), Ben Dewberry (Keyfactor), Bhat Abhishek (eMudhra), Brianca Martin (Amazon), Bruce Morton (Entrust), Corey Bonnell (DigiCert), Dean Coclin (DigiCert), Janet Hines (VikingCloud), Keshava N (eMudhra), Martijn Katerbarg (Sectigo), Mohit Kumar (GlobalSign), Roberto Quiñones (Intel), Scott Rea (eMudhra), Tim Crawford (BDO/WebTrust), Tim Hollebeek (DigiCert)

Minutes

**Antitrust statement: **The Antitrust statement was read.

Approval of minutes: Previous F2F meeting’s minutes still being compiled

  • Ballot: CSC 18 has passed and IPR review period is over

    • No claims received
  • Look into rebasing the last two Ballots into Dimitri’s branch

    • Now that the IPR period is over that can be done
  • Signing service Ballot

    • Most of the text is written but could now be out of Sync with updates coming in from Dimitri’s ballot
      • Need to recut the ballot after going through the previous ballot
  • High risk language change proposal (Bruce, Tim, and Ian)

    • Work on getting (High risk language, time stamping change, EB certificates, certificate transparency) discussion in a prioritized order
      • All items that have been talked about but nobody is working on a specific one
      • High risk can be done now, other two waiting on more fleshed out text
      • Certificate Transparency
      • Presentation on Certificate Transparency Coming up at an upcoming code signing meeting
    • Time Stamping change
      • Setting a requirement for time stamping, also impacts non code signing items
  • Time stamping authorities for code signing intermixed with time stamping authorities for other things and causes a number of problems but no need for it to necessarily continue
  • Potential next steps
        • Designate which timestamp servers are meant to be a codesigning according to the CAB forum code signing requirements
    • Prioritization discussions to come when Ian joins next
  • Next Call: July 13th

  • Adjourn

Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.7 - Ballot SMC09 - Nov 25, 2024

This ballot includes updates for the following: • Require pre-linting of leaf end entity Certificates starting September 15, 2025 • Require WebTrust for Network Security for audits starting after April 1, 2025 • Clarify that multiple certificatePolicy OIDs are allowed in end entity certificates • Clarify use of organizationIdentifer references • Update of Appendix A.2 Natural Person Identifiers This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Clint Wilson (Apple) and Martijn Katerbarg (Sectigo).

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).