Code Signing Certificate Working Group Minutes

Meeting Information

• Date: 9 July 2026

1. Antitrust Reminder

Martijn read the CA/Browser Forum antitrust reminder.

2. Review of Agenda

The agenda was reviewed. Dean reminded participants of the upcoming CA/Browser Forum elections. The Working Group is seeking candidates for leadership positions, including Vice-Chair.

3. Approval of Minutes

The following meeting minutes were approved without objection:

• 16 April 2026
• 30 April 2026
• 14 May 2026
• 11 June 2026

Martijn will publish the approved minutes to the public mailing list and website.

4. KYC and Threat Intelligence Sharing

Karina reported that Sean Farrell was unable to attend this meeting and is unavailable during the next several regularly scheduled meetings.

Sean is expected to present Microsoft’s Know Your Customer and threat intelligence sharing initiative, including the FoxTempest case that prompted the work. The initiative aims to improve information sharing between Microsoft and CAs and reduce the ability of malicious actors to move between CAs.

Microsoft is also considering whether supporting requirements should be introduced through the Microsoft Root Certificate Program or the Code Signing Baseline Requirements.

Karina will obtain Sean’s availability and propose three alternative meeting dates. Martijn will then poll the mailing list. The additional meeting will be recorded.

5. Deprecation of Non-EV Code Signing

Martijn proposed beginning work to deprecate the non-EV Code Signing requirements and establish a final issuance date. This would allow the Working Group to simplify the requirements before considering changes for organizational, individual, and open-source Code Signing profiles.

Trevoli suggested that the Working Group could create a clean version of the requirements and temporarily reference the previous version for certificates issued before the effective date, similar to the approach previously used for the Network Security Requirements.

There were no objections to exploring this direction. Martijn will begin preparing a draft.

7. Adjournment

The meeting was adjourned.

Attendees

Aaron Poulsen (SSL.com), Adam Fiock (SSL.com), Andrea Holland (IdenTrust), Brian Winters (IdenTrust), Dean Coclin (DigiCert), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Karina Sirota (Microsoft), Karolina Ruszczyńska (Asseco Data Systems SA (Certum)), Lora Randolph (Microsoft), Luis Cervantes (SSL.com), Luis Osses (Amazon), Martijn Katerbarg (Sectigo), Nome Huang (TrustAsia), Rebecca Kelly (SSL.com), Rich Smith (DigiCert), Scott Rea (eMudhra), Thomas Zermeno (SSL.com), Tim Crawford (CPA Canada/WebTrust), Trevoli Ponds-White (Amazon)