CA/Browser Forum
Home » All CA/Browser Forum Posts » 2025-04-17 Minutes of the Code Signing Certificate Working Group

2025-04-17 Minutes of the Code Signing Certificate Working Group

Minutes of CSCWG

April 17, 2025

These are the approved minutes of the CSCWG meeting of April 17th, 2025 as prepared by Martijn Katerbarg

Attendees

Bruce Morton (Entrust), Corey Bonnell (DigiCert), Dean Coclin (DigiCert), Inaba Atsushi (GlobalSign), Karina Sirota (Microsoft), Kateryna Aleksieieva (Asseco Data Systems SA (Certum)), Luis Cervantes (SSL.com), Marco Schambach (IdenTrust), Martijn Katerbarg (Sectigo), Nate Santiago (Microsoft), Nome Huang (TrustAsia), Rebecca Kelly (SSL.com), Thomas Zermeno (SSL.com), Tim Crawford (CPA Canada/WebTrust)

Note Well

Martijn Katerbarg read the Note Well.

Approval of prior meeting minutes

Minutes of the March 6th meeting have been approved

Membership applications

• Antony Vennard (Interested Party) - Approved

CSC-29: Aligning CSCWG BRs with recent SCWG ballots

CSC-29 failed due to missing a Certificate Consumer vote. Nate mentioned working together with Karina to make sure he’s registered as a voting member. Corey mentions that once that registration is in place. He can restart CSC-29 as CSC-30 with no changed except a later effective date.

Maximum validity of CS certificates

Microsoft wants to move forward on this ballot. Nate has discussed internally and is proposing an effective date 12 month in the future from when the ballot will be started. Nate will start off the ballot, the working group has offered assistance where needed.

PQC ballot

During the F2F it was agreed to support all there parameter sets for ML-DSA. The ballot is pending one additional endorser. Nate mentions wanting to review the ballot text and having that on his todo list prior to the next call.

Moving towards a single profile

No updates yet from Microsoft on this topic.

Any Other Business

Marco raises is the CSCWG needs to consider MPIC. It’s brought forward that there is no direct DCV or CAA requirements for code signing certificates, thus there not being a use for MPIC.

Meeting Adjourned

Latest releases
Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.10 - Ballot SMC012 - Jul 2, 2025

Introduces a new method for validation of mailbox control, using ACME for S/MIME as defined in RFC 8823: Extensions to Automatic Certificate Management Environment for End-User S/MIME Certificates.

Network and Certificate System Security Requirements
Version 2.0.5 (Ballot NS-008) - Jul 9, 2025

Edit this page
The Certification Authority Browser Forum (CA/Browser Forum) is a voluntary gathering of Certificate Issuers and suppliers of Internet browser software and other applications that use certificates (Certificate Consumers).