Home » All CA/Browser Forum Posts » 2024-01-14 Minutes of the S/MIME Certificate Working Group

2024-01-14 Minutes of the S/MIME Certificate Working Group

Minutes of SMCWG

January 14, 2026

These are the Minutes of the meeting described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.

1. Roll Call

2. Note well: Antitrust / Compliance Statement

3. Approval of past minutes

The following minutes were approved:

December 03
December 17

Minutes provided by Stephen Davidson.

4. Review Agenda

5. Membership

6. Discussion

The WG discussed two ballots underway at the Server Certificate Working group. It was agreed that text should be inserted in the S/MIME BR to maintain equivalency with SC96. Stephen Davidson shared a proposal at https://github.com/cabforum/smime/issues/298. Changes for SC94 were not considered necessary.
The WG revisited the subject of the user of clientAuth for SMTP-to-SMTP authentication. Stephen asked for assistance in determining the scale of adoption of such certificates. Andy Warner noted that he was seeking data.
Stephen presented a draft ballot https://github.com/cabforum/smime/compare/be9a18ab2b48eb0cbff41d3a268202f700c06c05...a4d2a8abcd43abe3ec8c5a6cb27cf4f3f97a4f51. Scott Rea noted that some of the changes were unnecessarily explicit as they restated the requirements of the ISO standard being quoted. Stephen agreed to redraft. It was agreed to move the change relating to XX country code to a standalone ballot. Ben Wilson previously agreed to endorse the mDL ballot. Scott Rea tentatively agreed to endorse, subject to updates being made.

7. Ballot Status Updates

In Development: Pseudonym, mDL, eID, section 7 re-write
In Discussion Period: NA
In Voting Period: NA
Under IPR Review: NA
Approved and Effective: SMC014: DNSSEC for CAA (October 13)

8. Next meeting:

January 28, 2026 at 11 am Eastern

9. Any other business

10. Adjourn

Attendees:

Adam Folson (IdenTrust), Albert de Ruiter (Logius PKIoverheid), Andreas Henschel (D-TRUST), Andy Warner (Google), Arman Asemani (Apple), Ashish Dhiman (GlobalSign), Ben Wilson (Mozilla), Dustin Hollenback (Apple), Hazhar Ismail (MSC Trustgate Sdn Bhd), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Judith Spencer (CertiPath), Luis Cervantes (SSL.com), Malcolm Idaho (IdenTrust), Marco Schambach (IdenTrust), Martijn Katerbarg (Sectigo), Nome Huang (TrustAsia), Ono Fumiaki (SECOM Trust Systems), Peter Miskovic (Disig), Rebecca Kelly (SSL.com), Rollin Yu (TrustAsia), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Sean Huang (TWCA), Stefan Selbitschka (rundQuadrat), Stephen Davidson (DigiCert), Tadahiko Ito (SECOM Trust Systems), Thomas Zermeno (SSL.com), Wiktoria Więckowska (Asseco Data Systems SA (Certum))

Latest releases

Server Certificate Requirements
SC094: Add partial exception for DNSSEC checks for email DCV methods - Feb 17, 2026

Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.12 - Ballot SMC014 - Oct 13, 2025

This ballot introduces requirements that a Certificate Issuer MUST deploy DNSSEC validation back to the IANA DNSSEC root trust anchor on all DNS queries associated with CAA record lookups performed by the Primary Network Perspective, effective March 15, 2026. The ballot is intended to maintain consistency in the S/MIME Baseline Requirements with the requirements of Ballot SC-085 which implemented identical requirements in the TLS Baseline Requirements. Note: SC-085 also introduced requirements in TLS Baseline Requirements for the use of DNSSEC in domain control validation. These requirements are automatically adopted in the S/MIME BR by the email domain control methods that include a normative reference to section 3.2.2.4 of the TLS Baseline Requirements. The draft also includes minor corrections to web links in the text. This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Client Wilson (Apple) and Ashish Dhiman (GlobalSign).

Network and Certificate System Security Requirements
Version 2.0.5 (Ballot NS-008) - Jul 9, 2025