Home » All CA/Browser Forum Posts » 2026-01-14 Minutes of the S/MIME Certificate Working Group

2026-01-14 Minutes of the S/MIME Certificate Working Group

Minutes of SMCWG

January 14, 2026

These are the Minutes of the meeting described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.

1. Roll Call

2. Note well: Antitrust / Compliance Statement

3. Approval of past minutes

The following minutes were approved:

December 03
December 17

Minutes provided by Stephen Davidson.

4. Review Agenda

5. Membership

6. Discussion

The WG discussed two ballots underway at the Server Certificate Working group. It was agreed that text should be inserted in the S/MIME BR to maintain equivalency with SC96. Stephen Davidson shared a proposal at https://github.com/cabforum/smime/issues/298. Changes for SC94 were not considered necessary.
The WG revisited the subject of the user of clientAuth for SMTP-to-SMTP authentication. Stephen asked for assistance in determining the scale of adoption of such certificates. Andy Warner noted that he was seeking data.
Stephen presented a draft ballot https://github.com/cabforum/smime/compare/be9a18ab2b48eb0cbff41d3a268202f700c06c05...a4d2a8abcd43abe3ec8c5a6cb27cf4f3f97a4f51. Scott Rea noted that some of the changes were unnecessarily explicit as they restated the requirements of the ISO standard being quoted. Stephen agreed to redraft. It was agreed to move the change relating to XX country code to a standalone ballot. Ben Wilson previously agreed to endorse the mDL ballot. Scott Rea tentatively agreed to endorse, subject to updates being made.

7. Ballot Status Updates

In Development: Pseudonym, mDL, eID, section 7 re-write
In Discussion Period: NA
In Voting Period: NA
Under IPR Review: NA
Approved and Effective: SMC014: DNSSEC for CAA (October 13)

8. Next meeting:

January 28, 2026 at 11 am Eastern

9. Any other business

10. Adjourn

Attendees:

Adam Folson (IdenTrust), Albert de Ruiter (Logius PKIoverheid), Andreas Henschel (D-TRUST), Andy Warner (Google), Arman Asemani (Apple), Ashish Dhiman (GlobalSign), Ben Wilson (Mozilla), Dustin Hollenback (Apple), Hazhar Ismail (MSC Trustgate Sdn Bhd), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Judith Spencer (CertiPath), Luis Cervantes (SSL.com), Malcolm Idaho (IdenTrust), Marco Schambach (IdenTrust), Martijn Katerbarg (Sectigo), Nome Huang (TrustAsia), Ono Fumiaki (SECOM Trust Systems), Peter Miskovic (Disig), Rebecca Kelly (SSL.com), Rollin Yu (TrustAsia), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Sean Huang (TWCA), Stefan Selbitschka (rundQuadrat), Stephen Davidson (DigiCert), Tadahiko Ito (SECOM Trust Systems), Thomas Zermeno (SSL.com), Wiktoria Więckowska (Asseco Data Systems SA (Certum))

Latest releases

Server Certificate Requirements
SC095v3: Clean-up 2025 - Apr 2, 2026

Code Signing Requirements
v3.8 - Aug 5, 2024

What’s Changed CSC-25: Import EV Guidelines to CS Baseline Requirements by @dzacharo in https://github.com/cabforum/code-signing/pull/38 Full Changelog: https://github.com/cabforum/code-signing/compare/v3.7...v3.8

S/MIME Requirements
v1.0.14 - Ballot SMC016 - May 5, 2026

This ballot maintains consistency between the S/MIME Baseline Requirements and the TLS Baseline Requirements with changes introduced by Ballots SC096 and SC097. Specifically, this ballot: Creates a carve-out of the logging requirements for DNSSEC specifically, stating these are not in scope. For audit purposes, change management logging is able to confirm if the appropriate controls are in effect or not. Sunsets all remaining use of SHA-1 signatures in Certificates and CRLs. It is noted that most uses of SHA-1 signatures are already deprecated by SC097. With this ballot, all unexpired Subordinate CA Certificates issuing S/MIME containing the SHA-1 signature algorithm must be revoked. This proposal does not prohibit the use of SHA-1 to generate issuerKeyHash or issuerNameHash values as currently required by RFC 5019. Includes minor formatting corrections.

Network and Certificate System Security Requirements
Version 2.0.5 (Ballot NS-008) - Jul 9, 2025