CA/Browser Forum posts
2023-10-26 Minutes of the CA/Browser Forum Teleconference
October 26, 2023 by Ben WilsonThese are the Final Minutes of the Teleconference described in the subject of this message, prepared by Michelle Coon (OATI). Attendance Aaron Poulsen – (Amazon), Abhishek Bhat – (eMudhra), Adam Jones – (Microsoft), Andrea Holland – (VikingCloud), Ben Wilson – (Mozilla), Brianca Martin – (Amazon), Brittany Randall – (GoDaddy), Clint Wilson – (Apple), Corey Bonnell – (DigiCert), Corey Rasmussen – (OATI), Dimitris Zacharopoulos – (HARICA), Doug Beattie – (GlobalSign), Dustin Hollenback – (Microsoft), Eva Vansteenberge – (GlobalSign), Inaba Atsushi – (GlobalSign), Janet Hines – (VikingCloud), Kiran Tummala – (Microsoft), Lynn Jeun – (Visa), Mads Henriksveen – (Buypass AS), Martijn Katerbarg – (Sectigo), Michelle Coon – (OATI), Nargis Mannan – (VikingCloud), Nate Smith – (GoDaddy), Nicol So – (CommScope), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Peter Miskovic – (Disig), Rebecca Kelley – (Apple), Rollin Yu – (TrustAsia Technologies Inc), Scott Rea – (eMudhra), Stephen Davidson – (DigiCert), Tadahiko Ito – (SECOM Trust Systems), Thomas Zermeno – (SSL.com), Tobias Josefowitz – (Opera Software AS), Trevoli Ponds-White – (Amazon), Wendy Brown – (US Federal PKI Management Authority), Yoshihiko Matsuo – (Japan Registry Services).** **
October 26, 2023 by Ben WilsonThese are the Final Minutes of the Teleconference described in the subject of this message, prepared by Michelle Coon (OATI). Attendance Aaron Poulsen – (Amazon), Abhishek Bhat – (eMudhra), Adam Jones – (Microsoft), Andrea Holland – (VikingCloud), Ben Wilson – (Mozilla), Brianca Martin – (Amazon), Brittany Randall – (GoDaddy), Clint Wilson – (Apple), Corey Bonnell – (DigiCert), Corey Rasmussen – (OATI), Dimitris Zacharopoulos – (HARICA), Doug Beattie – (GlobalSign), Dustin Hollenback – (Microsoft), Eva Vansteenberge – (GlobalSign), Inaba Atsushi – (GlobalSign), Janet Hines – (VikingCloud), Kiran Tummala – (Microsoft), Lynn Jeun – (Visa), Mads Henriksveen – (Buypass AS), Martijn Katerbarg – (Sectigo), Michelle Coon – (OATI), Nargis Mannan – (VikingCloud), Nate Smith – (GoDaddy), Nicol So – (CommScope), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Peter Miskovic – (Disig), Rebecca Kelley – (Apple), Rollin Yu – (TrustAsia Technologies Inc), Scott Rea – (eMudhra), Stephen Davidson – (DigiCert), Tadahiko Ito – (SECOM Trust Systems), Thomas Zermeno – (SSL.com), Tobias Josefowitz – (Opera Software AS), Trevoli Ponds-White – (Amazon), Wendy Brown – (US Federal PKI Management Authority), Yoshihiko Matsuo – (Japan Registry Services).** **
2023-10-25 Minutes of the S/MIME Certificate Working Group
October 25, 2023 by Stephen DavidsonMinutes of SMCWG October 25, 2023 These are the Approved Minutes of the Teleconference described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.
October 25, 2023 by Stephen DavidsonMinutes of SMCWG October 25, 2023 These are the Approved Minutes of the Teleconference described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.
2023-10-19 Minutes of the Code Signing Certificate Working Group
October 19, 2023 by Corey BonnellAttendees Aaron Poulsen – Amazon Trust Services Andrea Holland – VikingCloud Atsushi INABA – GlobalSign Bruce Morton – Entrust Corey Bonnell Dean Coclin-DigiCert Dimitris Zacharopoulos (HARICA) Ian McMillan – Microsoft Janet Hines – VikingCloud Richard Kisley – IBM Mohit Kumar – GlobalSign Rollin Yu – TrustAsia Scott Rea – eMudhra Tim Crawford – BDO/WebTrust Minutes Assign Minute taker (start recording) Ian McMillan Roll call Completed by Dean Antitrust Compliance Statement
October 19, 2023 by Corey BonnellAttendees Aaron Poulsen – Amazon Trust Services Andrea Holland – VikingCloud Atsushi INABA – GlobalSign Bruce Morton – Entrust Corey Bonnell Dean Coclin-DigiCert Dimitris Zacharopoulos (HARICA) Ian McMillan – Microsoft Janet Hines – VikingCloud Richard Kisley – IBM Mohit Kumar – GlobalSign Rollin Yu – TrustAsia Scott Rea – eMudhra Tim Crawford – BDO/WebTrust Minutes Assign Minute taker (start recording) Ian McMillan Roll call Completed by Dean Antitrust Compliance Statement
2023-10-05 Minutes of the F2F Code Signing Certificate Working Group
October 5, 2023 by Corey BonnellAttendeesAdam Jones – (Microsoft), Aleksandra Kurosz – (Asseco Data Systems SA (Certum)), Andrea Holland – (VikingCloud), Arvid Vermote – (GlobalSign), Ashish Dhiman – (GlobalSign), Ben Dewberry – (Keyfactor), Ben Wilson – (Mozilla), Brianca Martin – (Amazon), Bruce Morton – (Entrust), Christophe Bonjean – (GlobalSign), Clemens Wanko – (ACAB Council), Corey Bonnell – (DigiCert), Dave Chin – (CPA Canada/WebTrust), Dean Coclin – (DigiCert), Don Sheehy – (CPA Canada/WebTrust), Doug Beattie – (GlobalSign), Ellie Lu – (TrustAsia Technologies, Inc.), Eva Vansteenberge – (GlobalSign), Hannah Sokol – (Microsoft), Inaba Atsushi – (GlobalSign), Inigo Barreira – (Sectigo), Janet Hines – (VikingCloud), John Mason – (Microsoft), Jozef Nigut – (Disig), Kateryna Aleksieieva – (Asseco Data Systems SA (Certum)), Li-Chun Chen – (Chunghwa Telecom), Marcelo Silva – (Visa), Marco Schambach – (IdenTrust), Martijn Katerbarg – (Sectigo), Mohit Kumar – (GlobalSign), Nate Smith – (GoDaddy), Naveen Kumar – (eMudhra), Nikolaos Soumelidis – (ACAB Council), Nitesh Bakliwal – (Microsoft), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Rebecca Kelley – (Apple), Rich Kapushinski – (CommScope), Rollin Yu – (TrustAsia Technologies, Inc.), Roman Fischer – (SwissSign), Scott Rea – (eMudhra), Stephen Davidson – (DigiCert), Sven Rajala – (Keyfactor), Thomas Zermeno – (SSL.com), Tim Callan – (Sectigo), Tim Crawford – (CPA Canada/WebTrust), Tim Hollebeek – (DigiCert), Trevoli Ponds-White – (Amazon), Tsung-Min Kuo – (Chunghwa Telecom), Vijayakumar (Vijay) Manjunatha – (eMudhra)
October 5, 2023 by Corey BonnellAttendeesAdam Jones – (Microsoft), Aleksandra Kurosz – (Asseco Data Systems SA (Certum)), Andrea Holland – (VikingCloud), Arvid Vermote – (GlobalSign), Ashish Dhiman – (GlobalSign), Ben Dewberry – (Keyfactor), Ben Wilson – (Mozilla), Brianca Martin – (Amazon), Bruce Morton – (Entrust), Christophe Bonjean – (GlobalSign), Clemens Wanko – (ACAB Council), Corey Bonnell – (DigiCert), Dave Chin – (CPA Canada/WebTrust), Dean Coclin – (DigiCert), Don Sheehy – (CPA Canada/WebTrust), Doug Beattie – (GlobalSign), Ellie Lu – (TrustAsia Technologies, Inc.), Eva Vansteenberge – (GlobalSign), Hannah Sokol – (Microsoft), Inaba Atsushi – (GlobalSign), Inigo Barreira – (Sectigo), Janet Hines – (VikingCloud), John Mason – (Microsoft), Jozef Nigut – (Disig), Kateryna Aleksieieva – (Asseco Data Systems SA (Certum)), Li-Chun Chen – (Chunghwa Telecom), Marcelo Silva – (Visa), Marco Schambach – (IdenTrust), Martijn Katerbarg – (Sectigo), Mohit Kumar – (GlobalSign), Nate Smith – (GoDaddy), Naveen Kumar – (eMudhra), Nikolaos Soumelidis – (ACAB Council), Nitesh Bakliwal – (Microsoft), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Rebecca Kelley – (Apple), Rich Kapushinski – (CommScope), Rollin Yu – (TrustAsia Technologies, Inc.), Roman Fischer – (SwissSign), Scott Rea – (eMudhra), Stephen Davidson – (DigiCert), Sven Rajala – (Keyfactor), Thomas Zermeno – (SSL.com), Tim Callan – (Sectigo), Tim Crawford – (CPA Canada/WebTrust), Tim Hollebeek – (DigiCert), Trevoli Ponds-White – (Amazon), Tsung-Min Kuo – (Chunghwa Telecom), Vijayakumar (Vijay) Manjunatha – (eMudhra)
2023-10-05 (F2F#60) Minutes of the S/MIME Certificate Working Group
October 5, 2023 by Stephen DavidsonMinutes of SMCWG October 5, 2023 These are the Approved Minutes of the meeting described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.
October 5, 2023 by Stephen DavidsonMinutes of SMCWG October 5, 2023 These are the Approved Minutes of the meeting described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.
Minutes of the F2F 60 Meeting in Portsmouth, NH, October 3-4, 2023
October 4, 2023 by Ben WilsonMeeting 60 minutesCABF Face-to-Face Meeting 60: Day 1 October 3, 2023CA/Browser Forum level Meeting Attendance Aaron Gable – (Let’s Encrypt), Aaron Poulsen – (Amazon), Abhishek Bhat – (eMudhra), Adam Jones – (Microsoft), Adrian Mueller – (SwissSign), Adriano Santoni – (Actalis S.p.A.), Aleksandra Kurosz (Asseco Data Systems S.A.), Andrea Holland – (VikingCloud), Andreas Henschel (D-Trust), Aneta Wojtczak-Iwanicka – (Microsoft), Anna-Marie Christian (WebTrust / CPA Canada), Antti Backman – (Telia Company), Arno Fiedler – (ETSI), Arnold Essing (Telekom Security), Arvid Vermote – (GlobalSign), Ben Wilson – (Mozilla), Brianca Martin – (Amazon), Brittany Randall – (GoDaddy), Bruce Morton – (Entrust), Chris Clements – (Google), Christophe Bonjean – (GlobalSign), Clemens Wanko – (ACAB’c / TUV Austria), Clint Wilson – (Apple), Corey Bonnell – (DigiCert), Corey Bonnell (DigiCert), Corey Rasmussen – (OATI), Daryn Wright – (GoDaddy), Dave Chin – (CPA Canada/WebTrust), Dean Coclin (DigiCert), Dimitris Zacharopoulos – (HARICA), Don Sheehy (WebTrust), Doug Beattie – (GlobalSign), Ellie Lu – (TrustAsia Technologies Inc.), Enrico Entschew (D-Trust), Eva Vansteenberge – (GlobalSign), Hannah Sokol – (Microsoft), Hogeun Yoo – (NAVER Cloud), Ian McMillan – (Microsoft), Inaba Atsushi – (GlobalSign), Inigo Barreira – (Sectigo), Janet Hines – (VikingCloud), Jeremy Rowley – (DigiCert), Joanna Fox – (TrustCor Systems), Jochem van den Berge – (Logius PKIoverheid), John Mason (Microsoft), John Sarapata (Google Trust Services), Joseph Ramm – (OATI), Jozef Nigut – (Disig), Kateryna Aleksieieva – (Asseco Data Systems SA (Certum)), Keshava Nagaraju – (eMudhra), Kiran Tummala – (Microsoft), Leo Grove (SSL.com), Li-Chun Chen (ChungHwa Telecom), Lynn Jeun – (Visa), Mads Henriksveen – (Buypass AS), Marcelo Silva – (Visa), Marco Schambach – (IdenTrust), Martijn Katerbarg – (Sectigo), Michael Guenther – (SwissSign), Michael Slaughter – (Amazon), Michelle Coon – (OATI), Mohit Kumar (GlobalSign), Nargis Mannan – (VikingCloud), Nate Smith – (GoDaddy), Naveen Kumar – (eMudhra), Nicol So – (CommScope), Nikolaos Soumelidis (QMSCERT), Nitesh Bakliwal (Microsoft), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Pekka Lahtiharju – (Telia Company), Raffaela Achermann – (SwissSign), Rebecca Kelley – (Apple), Rich Kapushinski – (CommScope), Rob Brand (Ministry of Economic Affairs and climate Policy (NL)), Rob Stradling – (Sectigo), Rollin Yu – (TrustAsia Technologies Inc.), Roman Fischer (SwissSign AG), Ryan Dickson – (Google), Scott Rea – (eMudhra), Sissel Hoel – (Buypass AS), Stephen Davidson – (DigiCert), Steven Deitte – (GoDaddy), Sven Rajala – (Keyfactor), Tadahiko Ito – (SECOM Trust Systems), Tim Callan (Sectigo), Tim Crawford – (CPA Canada/WebTrust), Tim Hollebeek (DigiCert), Tobias Josefowitz – (Opera Software AS), Tom Zermeno (SSL.com), Trevoli Ponds-White – (Amazon), Tsung-Min Kuo – (Chunghwa Telecom), Vijayakumar (Vijay) Manjunatha – (eMudhra), Wayne Thayer – (Fastly), Wen-Chun Yang (ChungHwa Telecom), Wendy Brown – (US Federal PKI Management Authority), Xiu Lei – (GDCA).
October 4, 2023 by Ben WilsonMeeting 60 minutesCABF Face-to-Face Meeting 60: Day 1 October 3, 2023CA/Browser Forum level Meeting Attendance Aaron Gable – (Let’s Encrypt), Aaron Poulsen – (Amazon), Abhishek Bhat – (eMudhra), Adam Jones – (Microsoft), Adrian Mueller – (SwissSign), Adriano Santoni – (Actalis S.p.A.), Aleksandra Kurosz (Asseco Data Systems S.A.), Andrea Holland – (VikingCloud), Andreas Henschel (D-Trust), Aneta Wojtczak-Iwanicka – (Microsoft), Anna-Marie Christian (WebTrust / CPA Canada), Antti Backman – (Telia Company), Arno Fiedler – (ETSI), Arnold Essing (Telekom Security), Arvid Vermote – (GlobalSign), Ben Wilson – (Mozilla), Brianca Martin – (Amazon), Brittany Randall – (GoDaddy), Bruce Morton – (Entrust), Chris Clements – (Google), Christophe Bonjean – (GlobalSign), Clemens Wanko – (ACAB’c / TUV Austria), Clint Wilson – (Apple), Corey Bonnell – (DigiCert), Corey Bonnell (DigiCert), Corey Rasmussen – (OATI), Daryn Wright – (GoDaddy), Dave Chin – (CPA Canada/WebTrust), Dean Coclin (DigiCert), Dimitris Zacharopoulos – (HARICA), Don Sheehy (WebTrust), Doug Beattie – (GlobalSign), Ellie Lu – (TrustAsia Technologies Inc.), Enrico Entschew (D-Trust), Eva Vansteenberge – (GlobalSign), Hannah Sokol – (Microsoft), Hogeun Yoo – (NAVER Cloud), Ian McMillan – (Microsoft), Inaba Atsushi – (GlobalSign), Inigo Barreira – (Sectigo), Janet Hines – (VikingCloud), Jeremy Rowley – (DigiCert), Joanna Fox – (TrustCor Systems), Jochem van den Berge – (Logius PKIoverheid), John Mason (Microsoft), John Sarapata (Google Trust Services), Joseph Ramm – (OATI), Jozef Nigut – (Disig), Kateryna Aleksieieva – (Asseco Data Systems SA (Certum)), Keshava Nagaraju – (eMudhra), Kiran Tummala – (Microsoft), Leo Grove (SSL.com), Li-Chun Chen (ChungHwa Telecom), Lynn Jeun – (Visa), Mads Henriksveen – (Buypass AS), Marcelo Silva – (Visa), Marco Schambach – (IdenTrust), Martijn Katerbarg – (Sectigo), Michael Guenther – (SwissSign), Michael Slaughter – (Amazon), Michelle Coon – (OATI), Mohit Kumar (GlobalSign), Nargis Mannan – (VikingCloud), Nate Smith – (GoDaddy), Naveen Kumar – (eMudhra), Nicol So – (CommScope), Nikolaos Soumelidis (QMSCERT), Nitesh Bakliwal (Microsoft), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Pekka Lahtiharju – (Telia Company), Raffaela Achermann – (SwissSign), Rebecca Kelley – (Apple), Rich Kapushinski – (CommScope), Rob Brand (Ministry of Economic Affairs and climate Policy (NL)), Rob Stradling – (Sectigo), Rollin Yu – (TrustAsia Technologies Inc.), Roman Fischer (SwissSign AG), Ryan Dickson – (Google), Scott Rea – (eMudhra), Sissel Hoel – (Buypass AS), Stephen Davidson – (DigiCert), Steven Deitte – (GoDaddy), Sven Rajala – (Keyfactor), Tadahiko Ito – (SECOM Trust Systems), Tim Callan (Sectigo), Tim Crawford – (CPA Canada/WebTrust), Tim Hollebeek (DigiCert), Tobias Josefowitz – (Opera Software AS), Tom Zermeno (SSL.com), Trevoli Ponds-White – (Amazon), Tsung-Min Kuo – (Chunghwa Telecom), Vijayakumar (Vijay) Manjunatha – (eMudhra), Wayne Thayer – (Fastly), Wen-Chun Yang (ChungHwa Telecom), Wendy Brown – (US Federal PKI Management Authority), Xiu Lei – (GDCA).
2023-09-14 Minutes of the Server Certificate Working Group
September 29, 2023 by Iñigo BarreiraAttendance Aaron Gable – (Let’s Encrypt), Aaron Poulsen – (Amazon), Abhishek Bhat – (eMudhra), Adam Jones – (Microsoft), Adrian Mueller – (SwissSign), Andrea Holland – (VikingCloud), Ben Wilson – (Mozilla), Bruce Morton – (Entrust), Chad Ehlers – (IdenTrust), Chris Clements – (Google), Clint Wilson – (Apple), Corey Bonnell – (DigiCert), Corey Rasmussen – (OATI), Daryn Wright – (GoDaddy), Dimitris Zacharopoulos – (HARICA), Doug Beattie – (GlobalSign), Dustin Hollenback – (Microsoft), Enrico Entschew – (D-TRUST), Fumi Yoneda – (Japan Registry Services), Hannah Sokol – (Microsoft), Inaba Atsushi – (GlobalSign), Jos Purvis – (Fastly), Keshava Nagaraju – (eMudhra), Lynn Jeun – (Visa), Mads Henriksveen – (Buypass AS), Marcelo Silva – (Visa), Martijn Katerbarg – (Sectigo), Michelle Coon – (OATI), Mrugesh Chandarana – (IdenTrust), Nargis Mannan – (VikingCloud), Nate Smith – (GoDaddy), Nicol So – (CommScope), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Peter Miskovic – (Disig), Rebecca Kelley – (Apple), Rollin Yu – (TrustAsia Technologies, Inc.), Ryan Dickson – (Google), Scott Rea – (eMudhra), Stephen Davidson – (DigiCert), Tadahiko Ito – (SECOM Trust Systems), Thomas Zermeno – (SSL.com), Tobias Josefowitz – (Opera Software AS), Wayne Thayer – (Fastly), Yoshihiko Matsuo – (Japan Registry Services).
September 29, 2023 by Iñigo BarreiraAttendance Aaron Gable – (Let’s Encrypt), Aaron Poulsen – (Amazon), Abhishek Bhat – (eMudhra), Adam Jones – (Microsoft), Adrian Mueller – (SwissSign), Andrea Holland – (VikingCloud), Ben Wilson – (Mozilla), Bruce Morton – (Entrust), Chad Ehlers – (IdenTrust), Chris Clements – (Google), Clint Wilson – (Apple), Corey Bonnell – (DigiCert), Corey Rasmussen – (OATI), Daryn Wright – (GoDaddy), Dimitris Zacharopoulos – (HARICA), Doug Beattie – (GlobalSign), Dustin Hollenback – (Microsoft), Enrico Entschew – (D-TRUST), Fumi Yoneda – (Japan Registry Services), Hannah Sokol – (Microsoft), Inaba Atsushi – (GlobalSign), Jos Purvis – (Fastly), Keshava Nagaraju – (eMudhra), Lynn Jeun – (Visa), Mads Henriksveen – (Buypass AS), Marcelo Silva – (Visa), Martijn Katerbarg – (Sectigo), Michelle Coon – (OATI), Mrugesh Chandarana – (IdenTrust), Nargis Mannan – (VikingCloud), Nate Smith – (GoDaddy), Nicol So – (CommScope), Paul van Brouwershaven – (Entrust), Pedro Fuentes – (OISTE Foundation), Peter Miskovic – (Disig), Rebecca Kelley – (Apple), Rollin Yu – (TrustAsia Technologies, Inc.), Ryan Dickson – (Google), Scott Rea – (eMudhra), Stephen Davidson – (DigiCert), Tadahiko Ito – (SECOM Trust Systems), Thomas Zermeno – (SSL.com), Tobias Josefowitz – (Opera Software AS), Wayne Thayer – (Fastly), Yoshihiko Matsuo – (Japan Registry Services).
2023-09-28 Minutes of the CA/Browser Forum Teleconference
September 28, 2023 by Ben WilsonAttendance Aaron Gable (Let’s Encrypt), Aaron Poulsen (Amazon), Abhishek Bhat (eMudhra), Adam Clark (Visa), Adam Jones (Microsoft), Adrian Mueller (SwissSign), Andrea Holland (VikingCloud), Ben Wilson (Mozilla), Bilal Ashraf (SSL.com), Brianca Martin (Amazon), Bruce Morton (Entrust), Clint Wilson (Apple), Corey Bonnell (DigiCert), Corey Rasmussen (OATI), Daryn Wright (GoDaddy), Dean Coclin (DigiCert), Dustin Hollenback (Microsoft), Fumi Yoneda (Japan Registry Services), Hannah Sokol (Microsoft), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Jos Purvis (Fastly), Jozef Nigut (Disig), Keshava Nagaraju (eMudhra), Li-Chun Chen (Chunghwa Telecom), Lynn Jeun (Visa), Mads Henriksveen (Buypass AS), Martijn Katerbarg (Sectigo), Michelle Coon (OATI), Nargis Mannan (VikingCloud), Nate Smith (GoDaddy), Nicol So (CommScope), Paul van Brouwershaven (Entrust), Pedro Fuentes (OISTE Foundation), Rebecca Kelley (Apple), RIch Smith (DigiCert), Roman Fischer (SwissSign), Scott Rea (eMudhra), Tadahiko Ito (SECOM Trust Systems), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Yoshihiko Matsuo (Japan Registry Services)
September 28, 2023 by Ben WilsonAttendance Aaron Gable (Let’s Encrypt), Aaron Poulsen (Amazon), Abhishek Bhat (eMudhra), Adam Clark (Visa), Adam Jones (Microsoft), Adrian Mueller (SwissSign), Andrea Holland (VikingCloud), Ben Wilson (Mozilla), Bilal Ashraf (SSL.com), Brianca Martin (Amazon), Bruce Morton (Entrust), Clint Wilson (Apple), Corey Bonnell (DigiCert), Corey Rasmussen (OATI), Daryn Wright (GoDaddy), Dean Coclin (DigiCert), Dustin Hollenback (Microsoft), Fumi Yoneda (Japan Registry Services), Hannah Sokol (Microsoft), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Jos Purvis (Fastly), Jozef Nigut (Disig), Keshava Nagaraju (eMudhra), Li-Chun Chen (Chunghwa Telecom), Lynn Jeun (Visa), Mads Henriksveen (Buypass AS), Martijn Katerbarg (Sectigo), Michelle Coon (OATI), Nargis Mannan (VikingCloud), Nate Smith (GoDaddy), Nicol So (CommScope), Paul van Brouwershaven (Entrust), Pedro Fuentes (OISTE Foundation), Rebecca Kelley (Apple), RIch Smith (DigiCert), Roman Fischer (SwissSign), Scott Rea (eMudhra), Tadahiko Ito (SECOM Trust Systems), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Yoshihiko Matsuo (Japan Registry Services)
2023-09-27 Minutes of the S/MIME Certificate Working Group
September 27, 2023 by Stephen DavidsonMinutes of SMCWG September 27, 2023 These are the Approved Minutes of the Teleconference described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.
September 27, 2023 by Stephen DavidsonMinutes of SMCWG September 27, 2023 These are the Approved Minutes of the Teleconference described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.
2023-09-21 Minutes of the Code Signing Certificate Working Group
September 21, 2023 by Corey BonnellAttendeesAndrea Holland – VikingCloud, Atsushi INABA – GlobalSign, Brianca Martin – Amazon, Bruce Morton – Entrust, Corey Bonnell DigiCert, Ian McMillan Microsoft, Inigo Barreira, Martijn Katerbarg – Sectigo, Mohit Kumar – GlobalSign, Rollin Yu – TrustAsia, Scott Rea – eMudhra, Tim Crawford Minutes Roll Call – Bruce Morton – Entrust, Tim Crawford, Rollin Yu – TrustAsia, Atsushi INABA – GlobalSign, Scott Rea – eMudhra, Mohit Kumar – GlobalSign, Martijn Katerbarg – Sectigo, Inigo Barreira, Ian McMillan Microsoft, Andrea Holland – VikingCloud, Corey Bonnell DigiCert, Corey Bonnell DigiCert, Brianca Martin – Amazon Note well was read Approve prior meeting minutes – Sept 7 – not approved as the minutes were only provided for review on 21 September F2F Agenda, suggested items Private Keys in hardware feedback – There was generally no input as to whether this should be on the agenda. Ian stated it would be good to bring it up, but Bruce was not confident that there would be any feedback from the members, so would push to last on the agenda. Ballot: Remove EV Guideline refences (Dimitris) – Dimitris was not on the call to discuss. The goal will be to remove all EV Guidelines references, make adjustments where new text is not applicable to EV; then step 2 would be to adjust clauses to possibly make issuance of EV certificates easier. Note that it is impossible to issue an EV to an individual. It does not address consumer certificate. The client software does not make a distinction between non-EV and EV for code signing. Do we need all the clauses to authenticate certificate issuance? Should we make any changes, since the functionality of non-EV and EV is the same? For individuals we do require F2F for issuance of a code signing certificate. Do we need both non-EV and EV and if we do, what differences should they have? Also an issue with the due diligence validation where a person can approve vs. a machine. Do we need due diligence specified? Can we create a system for more consistent due diligence review? The goal was to require 2 people to get an EV certificate issued. Ballot: Charter update (Martijn) – Martijn agreed we could discuss at the F2F. Ballot: High Risk (Bruce/Ian) – Agreed to discuss at the F2F. Ian wants to ensure internally that we are not removing high risk as some items are still discussed in section 4.2.1 and 4.2.2. Should we consider changing a high risk certificate application as to when a subscriber which has been subject to a takeover attack requests a certificate? Individual and Organization verification mechanisms as discussed below. Review open Github items. Ballot Status Signing Service – Reviewed on last call. Tim has reviewed since and will endorse. Ian is reviewing, then hopefully will endorse. High Risk – Text has been drafted and Ian is reviewing. Charter Update – Martijn working on change. Time-stamp – Delay until other ballots are done. Other business – An email received from Tim McGrath from Microsoft. Ian knows the people that provided the email and will address. The question was about point-in-time for the address; but this is the type of data based on the CA review. Note there is no unique information included for an individual. An email address would be easy and unique for an individual and maybe we could drop location data. Can an individual specify a specific project for the signing, but the issue would be validating. It would be good if a CA could add information to distinguish an individual, so they would be added to a blocklist if they intentionally sign suspect code. What can we do to help protect relying parties? Perhaps we can brainstorm at the F2F about Individual and OV verification mechanisms. For organization, can we choose an existing model which is already defined in the CAB Forum. Would not like to create another model. Next meeting – F2F Oct 5 Adjourn
September 21, 2023 by Corey BonnellAttendeesAndrea Holland – VikingCloud, Atsushi INABA – GlobalSign, Brianca Martin – Amazon, Bruce Morton – Entrust, Corey Bonnell DigiCert, Ian McMillan Microsoft, Inigo Barreira, Martijn Katerbarg – Sectigo, Mohit Kumar – GlobalSign, Rollin Yu – TrustAsia, Scott Rea – eMudhra, Tim Crawford Minutes Roll Call – Bruce Morton – Entrust, Tim Crawford, Rollin Yu – TrustAsia, Atsushi INABA – GlobalSign, Scott Rea – eMudhra, Mohit Kumar – GlobalSign, Martijn Katerbarg – Sectigo, Inigo Barreira, Ian McMillan Microsoft, Andrea Holland – VikingCloud, Corey Bonnell DigiCert, Corey Bonnell DigiCert, Brianca Martin – Amazon Note well was read Approve prior meeting minutes – Sept 7 – not approved as the minutes were only provided for review on 21 September F2F Agenda, suggested items Private Keys in hardware feedback – There was generally no input as to whether this should be on the agenda. Ian stated it would be good to bring it up, but Bruce was not confident that there would be any feedback from the members, so would push to last on the agenda. Ballot: Remove EV Guideline refences (Dimitris) – Dimitris was not on the call to discuss. The goal will be to remove all EV Guidelines references, make adjustments where new text is not applicable to EV; then step 2 would be to adjust clauses to possibly make issuance of EV certificates easier. Note that it is impossible to issue an EV to an individual. It does not address consumer certificate. The client software does not make a distinction between non-EV and EV for code signing. Do we need all the clauses to authenticate certificate issuance? Should we make any changes, since the functionality of non-EV and EV is the same? For individuals we do require F2F for issuance of a code signing certificate. Do we need both non-EV and EV and if we do, what differences should they have? Also an issue with the due diligence validation where a person can approve vs. a machine. Do we need due diligence specified? Can we create a system for more consistent due diligence review? The goal was to require 2 people to get an EV certificate issued. Ballot: Charter update (Martijn) – Martijn agreed we could discuss at the F2F. Ballot: High Risk (Bruce/Ian) – Agreed to discuss at the F2F. Ian wants to ensure internally that we are not removing high risk as some items are still discussed in section 4.2.1 and 4.2.2. Should we consider changing a high risk certificate application as to when a subscriber which has been subject to a takeover attack requests a certificate? Individual and Organization verification mechanisms as discussed below. Review open Github items. Ballot Status Signing Service – Reviewed on last call. Tim has reviewed since and will endorse. Ian is reviewing, then hopefully will endorse. High Risk – Text has been drafted and Ian is reviewing. Charter Update – Martijn working on change. Time-stamp – Delay until other ballots are done. Other business – An email received from Tim McGrath from Microsoft. Ian knows the people that provided the email and will address. The question was about point-in-time for the address; but this is the type of data based on the CA review. Note there is no unique information included for an individual. An email address would be easy and unique for an individual and maybe we could drop location data. Can an individual specify a specific project for the signing, but the issue would be validating. It would be good if a CA could add information to distinguish an individual, so they would be added to a blocklist if they intentionally sign suspect code. What can we do to help protect relying parties? Perhaps we can brainstorm at the F2F about Individual and OV verification mechanisms. For organization, can we choose an existing model which is already defined in the CAB Forum. Would not like to create another model. Next meeting – F2F Oct 5 Adjourn