Final Minutes of CA/B Forum meeting December 4, 2025

• Approval of minutes:
  • November 6th minutes: approved
  • F2F minutes: approved
• Server Certificate Working Group update (Dimitris): Summary of November 20th meetings. Basically: summary of the ballots, not much progress.
• Validation: no meeting last week.
• Code Signing Certificate Working Group update (Martijn): no updates. Next meeting next week.
• S/MIME Certificate Working Group update (Stephen): invited guests. SMIME BR has made improvement over time in the security of the ecosystem. Additional study: relatively high occurrence of key-reuse. Topic for 2026. Number of ballots for the new year, relating to pseudonyms and mobile driver licenses. Upcoming discussions: SMTP to SMTP, close enough to SMIME to find out what the problem is. Next steps to be determined.
• NetSec Working Group update (Clint): Not much discussion on the re-write, but next steps on cloud services. Very specific use cases, implementation guidance. No specific driver for that though.
• Definitions and Glossary Working Group (Tim H.): Waiting for resource to become available.
• Forum Infrastructure Subcommittee update (Jos): No update. Membership tools are down at the moment. This may delay sending out emails of recordings and minutes, just the automated ones.
• Any Other Business: Proposal for new Membership category. Action to put in a ballot – will put a draft ballot forward in the next week.
• Next call: Dec 18, 2025

Attendees:
Aaron Gable (Let’s Encrypt), Aaron Poulsen (Amazon), Adriano Santoni (Actalis S.p.A.), Alvin Wang (SHECA), Antti Backman (Telia Company), Ben Wilson (Mozilla), Chad Dandar (Cisco Systems), Chris Clements (Google), Clint Wilson (Apple), Corey Bonnell (DigiCert), Cynethia Brown (US Federal PKI Management Authority), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Dustin Hollenback (Apple), Enrico Entschew (D-TRUST), Eric Kramer (Sectigo), Eva Vansteenberge (GlobalSign), Hogeun Yoo (NAVER Cloud Trust Services), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Jaime Hablutzel (OISTE Foundation), Jeanette Snook (Visa), Jeff Ward (CPA Canada/WebTrust), Johnny Reading (GoDaddy), Jun Okura (Cybertrust Japan), Kateryna Aleksieieva (Asseco Data Systems SA (Certum)), Lilia Dubko (CPA Canada/WebTrust), Lucy Buecking (IdenTrust), Mahua Chaudhuri (Microsoft), Marco Schambach (IdenTrust), Martijn Katerbarg (Sectigo), Masaru Sakamoto (Cybertrust Japan), Matthew McPherrin (Let’s Encrypt), Michael Slaughter (Amazon), Michelle Coon (OATI), Nargis Mannan (VikingCloud), Nate Smith (GoDaddy), Nome Huang (TrustAsia), Ono Fumiaki (SECOM Trust Systems), Pedro Fuentes (OISTE Foundation), Peter Miskovic (Disig), Rebecca Kelly (SSL.com), Rollin Yu (TrustAsia), Roman Fischer (SwissSign), Ryan Dickson (Google), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Sean Huang (TWCA), Stephen Davidson (DigiCert), Steven Deitte (GoDaddy), Tobias Josefowitz (Opera Software AS), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Yamian Quintero (Microsoft)