CA/Browser Forum posts
Welcome to the CA/Browser Forum
September 2, 2013 by Ben WilsonWelcome to the CA/Browser Forum. Organized in 2005, we are a voluntary group of certification authorities (CAs), vendors of Internet browser software, and suppliers of other applications that use X.509 v.3 digital certificates for SSL/TLS and code signing. The CA/Browser Forum began in 2005 as part of an effort among certification authorities and browser software vendors to provide greater assurance to Internet users about the websites they visit by leveraging the capabilities of SSL/TLS certificates. In June 2007, the CA/Browser Forum adopted version 1.0 of the Extended Validation (EV) Guidelines. EV certificates are issued after extended steps to verify the identity of the entity behind the domain receiving the certificate. Internet browser software displays enhanced indication of that identity by changing the appearance of its display (i.e. colors, icons, animation, and/or additional website information).
September 2, 2013 by Ben WilsonWelcome to the CA/Browser Forum. Organized in 2005, we are a voluntary group of certification authorities (CAs), vendors of Internet browser software, and suppliers of other applications that use X.509 v.3 digital certificates for SSL/TLS and code signing. The CA/Browser Forum began in 2005 as part of an effort among certification authorities and browser software vendors to provide greater assurance to Internet users about the websites they visit by leveraging the capabilities of SSL/TLS certificates. In June 2007, the CA/Browser Forum adopted version 1.0 of the Extended Validation (EV) Guidelines. EV certificates are issued after extended steps to verify the identity of the entity behind the domain receiving the certificate. Internet browser software displays enhanced indication of that identity by changing the appearance of its display (i.e. colors, icons, animation, and/or additional website information).
Ballot 107 – Removing Version Numbers to WebTrust and ETSI Standards From CABF Guidelines
August 9, 2013 by Ben WilsonBallot 107 – Removing Version Numbers to WebTrust and ETSI Standards From CABF Guidelines (Withdrawn) Mads Henriksveen made the following motion, and Inigo Barreira from Izenpe and Kirk Hall from Trend Micro endorsed it: Motion Begins Baseline Requirements (BR)
August 9, 2013 by Ben WilsonBallot 107 – Removing Version Numbers to WebTrust and ETSI Standards From CABF Guidelines (Withdrawn) Mads Henriksveen made the following motion, and Inigo Barreira from Izenpe and Kirk Hall from Trend Micro endorsed it: Motion Begins Baseline Requirements (BR)
Ballot 108 – Defining the Scope of the Baseline Requirements
August 6, 2013 by Ben WilsonBallot 108 – Defining the Scope of the Baseline Requirements (Withdrawn) Motion Jeremy Rowley made the following motion, and Stephen Davidson and Geoff Keating endorsed it: Motion Begins Amend Section 1 of the Baseline Requirements as follows: The Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates describe a subset of the requirements that a Certification Authority must meet in order to issue Publicly Trusted Certificates. Except where explicitly stated otherwise, these requirements apply only to relevant events that occur on or after the Effective Date.
August 6, 2013 by Ben WilsonBallot 108 – Defining the Scope of the Baseline Requirements (Withdrawn) Motion Jeremy Rowley made the following motion, and Stephen Davidson and Geoff Keating endorsed it: Motion Begins Amend Section 1 of the Baseline Requirements as follows: The Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates describe a subset of the requirements that a Certification Authority must meet in order to issue Publicly Trusted Certificates. Except where explicitly stated otherwise, these requirements apply only to relevant events that occur on or after the Effective Date.
Ballot 106 – Extended Deadline to Prohibit OCSP “Good” Response for Non-Issued Certificates
August 6, 2013 by Ben WilsonBallot 106 – Extended Deadline to Prohibit OCSP “Good” Response for Non-Issued Certificates (Withdrawn) Motion Given that several CAs have notified the CA/Browser Forum that they will be unable to comply with the 1-August-2013 deadline by which OCSP responders MUST NOT respond with a “good” status for unissued certificates, and that a one-year extension of this deadline is an appropriate timeframe by which these CAs should be able to come into compliance;
August 6, 2013 by Ben WilsonBallot 106 – Extended Deadline to Prohibit OCSP “Good” Response for Non-Issued Certificates (Withdrawn) Motion Given that several CAs have notified the CA/Browser Forum that they will be unable to comply with the 1-August-2013 deadline by which OCSP responders MUST NOT respond with a “good” status for unissued certificates, and that a one-year extension of this deadline is an appropriate timeframe by which these CAs should be able to come into compliance;
Ballot 105 – Technical Constraints for Subordinate Certificate Authorities Yielding Broader and Safer PKI Adoption.
July 29, 2013 by Ben WilsonBallot 105 – Technical Constraints for Subordinate Certificate Authorities Yielding Broader and Safer PKI Adoption. (Passed) Motion Steve Roylance made the following motion, and Gervase Markham from Mozilla and Stephen Davidson from QuoVadis endorsed it: Motion Begins EFFECTIVE IMMEDIATELY, this ballot provides clarity to the language covering external audits for Subordinate CAs, removing ambiguity as well as providing better alignment of the Baseline Requirements to the Mozilla CA Root program where the subject is already covered and accepted by the wider PKI community. In addition, the proposal sets out to aid wider and broader PKI adoption by Subordinate CAs by defining the use of Technical Constraints and highlighting how additional barriers to adoption within the guidelines can be optional when using Name Constraints, specifically the requirement for ‘OCSP Good’ responses originally proposed in Ballot 100. We propose amending the Baseline Requirements Guidelines as follows:
July 29, 2013 by Ben WilsonBallot 105 – Technical Constraints for Subordinate Certificate Authorities Yielding Broader and Safer PKI Adoption. (Passed) Motion Steve Roylance made the following motion, and Gervase Markham from Mozilla and Stephen Davidson from QuoVadis endorsed it: Motion Begins EFFECTIVE IMMEDIATELY, this ballot provides clarity to the language covering external audits for Subordinate CAs, removing ambiguity as well as providing better alignment of the Baseline Requirements to the Mozilla CA Root program where the subject is already covered and accepted by the wider PKI community. In addition, the proposal sets out to aid wider and broader PKI adoption by Subordinate CAs by defining the use of Technical Constraints and highlighting how additional barriers to adoption within the guidelines can be optional when using Name Constraints, specifically the requirement for ‘OCSP Good’ responses originally proposed in Ballot 100. We propose amending the Baseline Requirements Guidelines as follows:
Notice of IPR Review Period for EV Amendments Made by Ballots 101 and 104
July 29, 2013 by Ben WilsonPursuant to Section 4.1 of the CA/Browser Forum’s IPR Policy, this is notice of the commencement of a 30-day IPR maintenance-guideline review period by which certain provisions of the IPR will become applicable to these recent changes made to the EV Guidelines (by Ballots 101 and 104). During this IPR review period you are to review these amendments and consider any licensing obligations with respect to any Essential Claims that may be encompassed by such amendments.
July 29, 2013 by Ben WilsonPursuant to Section 4.1 of the CA/Browser Forum’s IPR Policy, this is notice of the commencement of a 30-day IPR maintenance-guideline review period by which certain provisions of the IPR will become applicable to these recent changes made to the EV Guidelines (by Ballots 101 and 104). During this IPR review period you are to review these amendments and consider any licensing obligations with respect to any Essential Claims that may be encompassed by such amendments.
Notice of IPR Review Period for BR Amendments Made by Ballots 96, 97, 99, 102 and 105
July 29, 2013 by Ben WilsonThe following changes have been made to the Baseline Requirements since the last Notice of IPR Review Period: Ballot 96 amended sections 11.1.3 and 11.1.4 dealing with Wildcards and new gTLDs. Ballot 97 – Prevention of Unknown Certificate Contents – amended section 10.2.3 and Appendix B and also addressed RFC 5280. Ballot 99 added an allowance for DSA keys to Appendix B Ballot 102 amended section 9.2.3 concerning the use of domainComponents in certificates.
July 29, 2013 by Ben WilsonThe following changes have been made to the Baseline Requirements since the last Notice of IPR Review Period: Ballot 96 amended sections 11.1.3 and 11.1.4 dealing with Wildcards and new gTLDs. Ballot 97 – Prevention of Unknown Certificate Contents – amended section 10.2.3 and Appendix B and also addressed RFC 5280. Ballot 99 added an allowance for DSA keys to Appendix B Ballot 102 amended section 9.2.3 concerning the use of domainComponents in certificates.
2013-07-25 Minutes
July 25, 2013 by Ben WilsonNotes of meeting CAB Forum 25 July 2013 Version 1 Present: Rick Andrews, Kirk Hall, Atsushi Inaba, Ben Wilson, Eddy Nigg, Mads Henriksveen, Sissel Hoel, Dean Coclin, Jeremy Rowley, Ryan Sleevi, Robin Alden, Steve Roylance, Mert Ozarar, Atilla Biler Agenda review: Approved as published. Minutes: Minutes of July 11, 2013 were circulated on July 18, 2013 Ballots: Ballot 103- Ben will fix and recirculate; Ballot 104 – EVG v. 1.4.3 will be circulated; Ballot 105 – so far we have received 13 votes, 11 yes and two abstained. Three of the browser have voted yes. Ballot 106 there have been many comments. Do we want to discuss now? No, we’ll continue discussions on the list. Ballot 107 – Mads needs another endorser. Iñigo said he would endorse with a minor change. Ballot 89 – Rick said he had sent to Tom for review. He’ll follow up when Tom gets back from vacation, but he wants to put it to bed–either put out a new document or get rid of the old one on the web site. Ballot 108 – Jeremy noted that the current Baseline Requirements are not clear on when they apply. He suggests that SSL certificates be defined for purposes of the Baseline Requirements as certificates with the server authentication EKU. Ryan S. wants to ensure that the Baseline Requirements correctly address Intermediate CAs as well. Jeremy agreed and said he would add that in.
July 25, 2013 by Ben WilsonNotes of meeting CAB Forum 25 July 2013 Version 1 Present: Rick Andrews, Kirk Hall, Atsushi Inaba, Ben Wilson, Eddy Nigg, Mads Henriksveen, Sissel Hoel, Dean Coclin, Jeremy Rowley, Ryan Sleevi, Robin Alden, Steve Roylance, Mert Ozarar, Atilla Biler Agenda review: Approved as published. Minutes: Minutes of July 11, 2013 were circulated on July 18, 2013 Ballots: Ballot 103- Ben will fix and recirculate; Ballot 104 – EVG v. 1.4.3 will be circulated; Ballot 105 – so far we have received 13 votes, 11 yes and two abstained. Three of the browser have voted yes. Ballot 106 there have been many comments. Do we want to discuss now? No, we’ll continue discussions on the list. Ballot 107 – Mads needs another endorser. Iñigo said he would endorse with a minor change. Ballot 89 – Rick said he had sent to Tom for review. He’ll follow up when Tom gets back from vacation, but he wants to put it to bed–either put out a new document or get rid of the old one on the web site. Ballot 108 – Jeremy noted that the current Baseline Requirements are not clear on when they apply. He suggests that SSL certificates be defined for purposes of the Baseline Requirements as certificates with the server authentication EKU. Ryan S. wants to ensure that the Baseline Requirements correctly address Intermediate CAs as well. Jeremy agreed and said he would add that in.