CA/Browser Forum
Home » All CA/Browser Forum Posts » Ballots CSC-25 and CSC-26

Ballots CSC-25 and CSC-26

RESULTS OF REVIEW PERIOD

CSC-25

Ballot CSC 25: Import EV Guidelines into the Code Signing Baseline Requirements

The Intellectual Property Review (IPR) period for Ballot CSC25: Import EV Guidelines into the Code Signing Baseline Requirements has completed. No IPR Exclusion Notices were filed, and the ballot is adopted as of Aug 1, 2024.

The new Code Signing BRs will be published to the CABF public website in accordance with the Bylaws.

CSC-26

Ballot CSC 26: Timestamping Private Key Protection Ballot

The Intellectual Property Review (IPR) period for Ballot CSC26: Timestamping Private Key Protection Ballot has completed. No IPR Exclusion Notices were filed, and the ballot is adopted as of Aug 1, 2024.

The new Code Signing BRs will be published to the CABF public website in accordance with the Bylaws.

CSC-25

Results of Voting

YesNoAbstain
Certificate IssuersCertum, DigiCert, Entrust, HARICA, Identrust, Sectigo
Certificate ConsumersMicrosoft

Purpose of the Ballot

This ballot updates the “Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates“ version 3.7 in order to clarify language regarding Timestamp Authority Private Key Protection. The main goals of this ballot are to:

  1. Import all CSBR references that point to the EV Guidelines with the actual language of corresponding sections of version 1.8.0 of the EV Guidelines, in order to remove external dependencies.
  2. The Code Signing Working Group decided not to import rules related to the subject:organizationIdentifier field.

The following motion has been proposed by Dimitris Zacharopoulos of HARICA and endorsed by Martijn Katerbarg of Sectigo and Corey Bonnell of Digicert.

Motion

MODIFY the “Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates” (“Code Signing Baseline Requirements”) based on version 3.7 as specified in the following redline: https://github.com/cabforum/code-signing/compare/d431d9104094f2b89f35ed4bf1d64b9a844e762b...d5af6d895b3666b5351509ad25d47ac5e87321fc

CSC-26

Results of Voting

YesNoAbstain
Certificate IssuersCertum, DigiCert, eMudhra, Entrust, GlobalSign, IdenTrust, Sectigo, SSL.com
Certificate ConsumersMicrosoft

Purpose of the Ballot

This ballot updates the “Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates“ version 3.7 in order to clarify language regarding Timestamp Authority Private Key Protection. The main goals of this ballot are to:

  1. Require Timestamp Authority Subordinate CA Private Keys to be stored in offline HSMs
  2. Add a requirement to remove Private Keys associated with Timestamp Certificates after a 18 months
  3. Add a requirement to reject SHA-1 timestamp requests

The following motion has been proposed by Martijn Katerbarg of Sectigo and endorsed by Bruce Morton of Entrust and Ian McMillan of Microsoft.

Motion

This ballot updates the “Baseline Requirements for the Issuance and Management of Publicly‐Trusted Code Signing Certificates” (“Code Signing Baseline Requirements”) based on version 3.7. MODIFY the Code Signing Baseline Requirements as specified in the following redline: https://github.com/cabforum/code-signing/compare/d431d9104094f2b89f35ed4bf1d64b9a844e762b...12130ff7c2b41d795d47925c084780ea0f7328cd

Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.7 - Ballot SMC09 - Nov 25, 2024

This ballot includes updates for the following: • Require pre-linting of leaf end entity Certificates starting September 15, 2025 • Require WebTrust for Network Security for audits starting after April 1, 2025 • Clarify that multiple certificatePolicy OIDs are allowed in end entity certificates • Clarify use of organizationIdentifer references • Update of Appendix A.2 Natural Person Identifiers This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Clint Wilson (Apple) and Martijn Katerbarg (Sectigo).

Network and Certificate System Security Requirements
v2.0 - Ballot NS-003 - Jun 26, 2024

Ballot NS-003: Restructure the NCSSRs in https://github.com/cabforum/netsec/pull/35

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).