2026-07-29 Minutes of the S/MIME Certificate Working Group

Minutes of SMCWG

July 29, 2026

These are the Minutes of the meeting described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.

1.       Roll Call 
   

2.       Note well:  Antitrust / Compliance Statement
   

3.       Approval of past minutes
   

• July 15 deferred

Minutes were taken by Stephen Davidson.

4.       Review Agenda 
   

5.       Membership
   

NA.

6.        Discussion
   

   • Stephen Davidson noted that Ballot SMC017v2 was in IPR through July 30. He noted this ballot had early impact, requiring new S/MIME roots and ICAs created starting September 15 to be at least 4096 if using RSA. Ashish Dhiman noted that NIST standards were also emphasizing stepup of RSA key sizes, and said that a future ballot might consider stepping up the minimum RSA key size for leaf certificates.
   • Stephen also noted changes that were taking effect in CCADB that were relevant to CA members.
   • The WG reviewed the draft Ballot SMC018: Realignment of Multipurpose use cases. See https://github.com/cabforum/smime/pull/306/changes. Stephen noted that the item related to the CCADB Section 6.3 would be effective immediately, and that other changes would take effect on July 1, 2027 which corresponded to the matching requirements in the Apple Policy v2, whose release is imminent. He thanked Apple for the early exposure to the draft of those changes, which had the impact of truncating in some cases the legacy S/MIME practices overlapping with other use cases like document signing. Following the discussion, the WG agreed the draft was ready to move to formal discussion.

7.       Ballot Status Updates
   

   • In Development: Pseudonym, cross-cert restrictions
   • In Discussion Period: NA
   • In Voting Period: NA
   • Under IPR Review: Ballot SMC017v2: Increase Minimum RSA CA Key Size until July 30
   • Approved and Effective: Ballot SMC016: Equivalence with Ballots SC096 and SC097 as of May 5

8.       Next meeting:
   

   • Wednesday, August 12, 2026 at 11:00 am Eastern time

9.        Any other business
   

10.    Adjourn
    

Attendees:

Adam Fiock (SSL.com), Adriano Santoni (Actalis S.p.A.), Albert de Ruiter (Logius PKIoverheid), Andrea Holland (IdenTrust), Andy Warner (Google), Arman Asemani (Apple), Ashish Dhiman (GlobalSign), Ben Wilson (Mozilla), Dustin Hollenback (Apple), Guillaume Amringer (Carillon Information Security Inc.), Inaba Atsushi (GlobalSign), Jozef Nigut (Disig), Judith Spencer (CertiPath), Luis Cervantes (SSL.com), Malcolm Idaho (IdenTrust), Nome Huang (TrustAsia), Ono Fumiaki (SECOM Trust Systems), Pedro Fuentes (OISTE Foundation), Rebecca Kelly (SSL.com), Rollin Yu (TrustAsia), Russ Housley (Vigil Security LLC), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Sean Huang (TWCA), Stefan Kirch (Deutsche Telekom Security GmbH), Stephen Davidson (DigiCert), Tadahiko Ito (SECOM Trust Systems), Tim Crawford (CPA Canada/WebTrust), Wendy Brown (US Federal PKI Management Authority)