Code Signing Certificate Working Group Meeting Minutes

Date: April 2, 2026

Note-Well

The Note-Well was read.

Review of Agenda

The agenda was sent out on Tuesday. Martijn added two items: an interested party application that was received, and Adriano Santoni’s ballot proposal.

Discussion Topics

Interested Party Application

An interested party application was received from Cigin Joseph, applying for the Code Signing Certificate Working Group and the Server Certificate Working Group. The signed IPR agreement is already in place. No objections were raised; the application was approved. Martijn will add the IPR agreement to the wiki.

Ballot Proposal – Mandatory Inclusion of CA/Browser Forum Reserved OIDs

Adriano Santoni presented a proposal to make the inclusion of one of the CA/Browser Forum reserved OIDs mandatory in code signing certificate policies, while making the inclusion of other proprietary OIDs optional. He shared a link to the proposed language in the chat.

Adriano noted that the change is straightforward and aims to:

• Improve coherence with the other Baseline Requirements (e.g., TLS BRs), which already require this.
• Better align with the Microsoft Root Program, which already mandates the inclusion of these OIDs.

Martijn agreed the change appears straightforward and in line with the Microsoft Root Program. No objections were raised from the group.

Adriano confirmed he has not yet secured endorsers. Karina indicated she would be happy to endorse after reviewing the proposed language and would follow up via email. Dean suggested sending the proposal to the mailing list given the small representation on the call, to give more people the opportunity to review.

Martijn offered to help Adriano with getting the ballot started if needed.

Next Steps After Microsoft Presentation at F2F

Martijn noted that the Microsoft presentation from the face-to-face needs to be shared with the group. Karina will send it to Martijn.

The group discussed next steps following the F2F discussion. One key topic identified was potentially enabling open-source projects to be validated and included in code signing certificates.

Karina indicated she has a couple of ballot proposals in progress — not specifically related to open source, but addressing other items discussed at the F2F. She expects to send those to the group the following week. She noted that this work is one of her goals for the current semester at Microsoft.

Martijn encouraged Karina to send out the ballots so the group can begin discussing them. The group agreed this is a good approach going forward.

Any Other Business

None.

Adjourn

Next Meeting: April 16, 2026

Attendees

Adriano Santoni (Actalis S.p.A.), Corey Bonnell (DigiCert), Dean Coclin (DigiCert), Inaba Atsushi (GlobalSign), Karina Sirota (Microsoft), Karolina Ruszczyńska (Asseco Data Systems SA (Certum)), Luis Cervantes (SSL.com), Martijn Katerbarg (Sectigo), Nome Huang (TrustAsia), Thomas Zermeno (SSL.com), Wiktoria Więckowska (Asseco Data Systems SA (Certum))