Ballot SMC017: Increase Minimum RSA CA Key Size
Ballot SMC017: Increase Minimum RSA CA Key Size
Ballot SMC017 was withdrawn on May 12, 2026.
Ballot SMC017: Increase Minimum RSA CA Key Size
Summary:
This ballot increases the minimum RSA key size for Root and Subordinate CA certificates in the S/MIME BRs from 2048 to 4096 bits for keys created on or after September 15, 2026, while retaining the 2048-bit minimum for Subscriber certificates.
The ballot further requires that by September 15, 2027, CAs SHALL NOT issue certificates from any Sub-CA whose RSA key modulus is less than 4096 bits, effectively sunsetting issuance from legacy 2048-bit Sub-CAs.
This ballot is proposed by Stephen Davidson (DigiCert) and endorsed by Ben Wilson (Mozilla) and Roman Fischer (SwissSign).
— Motion Begins —
This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted S/MIME Certificates” (“S/MIME Baseline Requirements”), based on Version 1.0.13.
MODIFY the Baseline Requirements as specified in the following Redline:
— Motion Ends —
This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:
Discussion (at least 7 days)
Start time: April 29, 2026 at 18:30:00 UTC
End time: May 6, 2026 at 18:30:00 UTC
Voting for Approval
Start time: May 6, 2026 at 21:30:00 UTC
End time: May 13, 2026 at 21:30:00 UTC