2026-06-25 Minutes of the Code Signing Certificate Working Group
Code Signing Certificate Working Group Minutes
Meeting Information
- Date: 25 June 2026
1. Antitrust Reminder
Thomas read the CA/Browser Forum antitrust reminder.
2. Agenda
The agenda was reviewed without changes.
3. KYC and Threat Intelligence Sharing
Karina stated that Microsoft would provide a presentation at the next meeting in two weeks. Sean Farrell from Microsoft’s internal task force is expected to present background on the KYC and threat intelligence sharing initiative, including the case that prompted the work.
Microsoft is primarily interested in obtaining actionable information from Code Signing certificates and related validation processes. Microsoft is considering whether requirements should be established through the CA/Browser Forum, direct relationships with CAs, or both.
4. Unified Code Signing Profile
Participants discussed Microsoft’s anticipated move from separate Code Signing and EV Code Signing assurance levels to a single profile.
CAs are receiving customer questions about the timeline, assurance level, and name of the future certificate. No published transition timeline was identified.
Microsoft currently expects to call the unified certificate a Code Signing certificate, but is flexible regarding terminology. The initial organizational profile will likely remain close to the existing EV Code Signing profile.
Separate validation profiles may be needed for individuals and open-source projects. Microsoft welcomed proposals from Working Group participants. Trevoli offered access to Amazon open-source experts to review potential ideas.
No formal decisions were made regarding naming, profile requirements, or implementation dates.
5. Post-Quantum Cryptography
Karina stated that Microsoft currently expects to focus on composite approaches for third parties, tentatively around Q1 2027. Progress depends on the relevant IETF composite profiles.
Microsoft may provide an update at the Vienna face-to-face meeting if additional information is available.
7. Adjournment
The meeting was adjourned.
Attendees
Aaron Poulsen (SSL.com), Adam Fiock (SSL.com), Andrea Holland (IdenTrust), Brian Winters (IdenTrust), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Karina Sirota (Microsoft), Kateryna Aleksieieva (Asseco Data Systems SA (Certum)), Luis Osses (Amazon), Nome Huang (TrustAsia), Scott Rea (eMudhra), Thomas Zermeno (SSL.com), Trevoli Ponds-White (Amazon)