Home » All CA/Browser Forum Posts » 2024-02-08 Minutes of the Code Signing Certificate Working Group

2024-02-08 Minutes of the Code Signing Certificate Working Group

Attendees

Abhishek Bhat (eMudhra), Ben Dewberry (Keyfactor), Brianca Martin (Amazon), Bruce Morton (Entrust), Corey Bonnell (DigiCert), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Ian McMillan (Microsoft), Inaba Atsushi (GlobalSign), Inigo Barreira (Sectigo), Keshava Nagaraju (eMudhra), Mohit Kumar (GlobalSign), Richard Kisley (IBM), Scott Rea (eMudhra), Thomas Zermeno (SSL.com)

Minutes

Dean read the note well.

Meeting minutes for January 25th meeting were approved.

Import EVG references into CSBRs

Dimitris gave status update for removing references to EVGs. A mapping spreadsheet was provided on the list to facilitate comparison. Dimitris gave the group a walkthrough of the document. Dimitris added the organizationIdentifier field, as it’s in the EVGs but not the CSBRs. Bruce said that introducing the orgId attribute is a change to the profile and should be a separate document. Dimitris proposed that he will circulate a diff of EVG 1.7.2 and 1.8.0 so the group can compare the differences in normative requirements between the versions.

Timestamping

Bruce said that Martijn has a ballot proposal on Github. Ian would like to halve the maximum validity of the end-entity timestamp certificate. Bruce said the motivation of requiring key destruction is that long-lived timestamp certificates are not a risk if the private key material is destroyed. Also, a long-lived certificate provides interoperability with other ecosystems, such as Java. Ian said that long-lived certificates might be a burden for CAs in providing OCSP responses for potentially several decades. Bruce said that we can raise this point as feedback to the ballot.

F2F discussion

Dean said that the February 22nd meeting is cancelled. Dean asked the group for topics to discuss.

Ian provided these topics:

Certificate transparency requirements for code signing certificates. Which activities that are logged (issuance, revocation) would be good to discuss. Also, which monitors are needed in the ecosystem?
Reduction of code signing certificate validity to 15 months

Bruce called for additional topics for the F2F. Dimitris said he will prepare the import of the EVGs for presentation at the F2F.

Meeting adjourned. Next meeting is at the F2F; the February 22nd meeting is cancelled.

Latest releases

Server Certificate Requirements
SC099: Improve Recording of Validation Methods - May 19, 2026

Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.14 - Ballot SMC016 - May 5, 2026

This ballot maintains consistency between the S/MIME Baseline Requirements and the TLS Baseline Requirements with changes introduced by Ballots SC096 and SC097. Specifically, this ballot: Creates a carve-out of the logging requirements for DNSSEC specifically, stating these are not in scope. For audit purposes, change management logging is able to confirm if the appropriate controls are in effect or not. Sunsets all remaining use of SHA-1 signatures in Certificates and CRLs. It is noted that most uses of SHA-1 signatures are already deprecated by SC097. With this ballot, all unexpired Subordinate CA Certificates issuing S/MIME containing the SHA-1 signature algorithm must be revoked. This proposal does not prohibit the use of SHA-1 to generate issuerKeyHash or issuerNameHash values as currently required by RFC 5019. Includes minor formatting corrections.

Network and Certificate System Security Requirements
Version 2.0.5 (Ballot NS-008) - Jul 9, 2025