CA/Browser Forum posts
Posts by tag Forum
2026-09-10 Minutes of the Forum
September 10, 2026 by 2026-09-10 Minutes of the ForumMinutes: CA/B Forum Plenary Meeting - September 10, 2026 1. Opening Tim Callan (Sectigo) opened the plenary and the Note Well was read. Dustin Hollenback (Apple) took the minutes. Minutes Approval: Tim Callan (Sectigo) asked whether anyone opposed approval of the minutes of 2026-08-27. Hearing no opposition, those minutes were approved. 2. Working Group Updates Server Certificate Working Group: Dimitris Zacharopoulos (HARICA) reported that the working group had spent most of its previous meeting on reasons for revocation, a discussion led by Ben Wilson (Mozilla), who described a process for establishing why certificates are revoked and what problems revocation is intended to solve. Rather than create a subcommittee or ad hoc group, the working group decided to use the Server Certificate Working Group mailing list with specific subject tags to drive that discussion. The remainder of the time was spent on face-to-face agenda topics. Validation Subcommittee: Stephen Davidson (DigiCert) reported that the subcommittee’s last teleconference went through a series of proposals from Rich Smith (DigiCert) on modernizing aspects of the EV Guidelines, now circulated as a fully formed set of redlines. He noted the redlines went to the Server Certificate Working Group list rather than the Validation Subcommittee list; Rich Smith (DigiCert) confirmed he had intended to send them to validation but that they went to servercert, and he left them there. Stephen Davidson (DigiCert) also reported that discussion has begun, and will continue at the face-to-face and beyond, on the use of AI-based tools in conducting validation. The white paper and presentation materials are on the Validation Subcommittee mailing list. He invited insight from anyone with a view on how AI can be used in support of validation tasks under the CA/Browser Forum standards, on what guardrails should be imposed, and on record-keeping changes that might be advisable when AI is used. Code Signing Certificate Working Group: Martijn Katerbarg (Sectigo) reported the working group started meeting again last week and has mainly planned for the face-to-face. Microsoft gave a short update on threat intelligence sharing, for which they are starting a pilot with a small number of Certification Authorities, with the expectation it will expand over time. Face-to-face topics will include clarifying ambiguous language on the organization name in Code Signing Certificates when combined with an individual Code Signing Certificate, concerns raised about the reuse of private keys and key pairs, and a proposal to align the Code Signing guidelines with the TLS documents on Section 7. S/MIME Certificate Working Group: Stephen Davidson (DigiCert) reported that SMC-018, a ballot realigning the multi-purpose use cases, passed and is in IPR review until 2026-09-24, and encouraged anyone wishing to conduct a review to do so. He noted that if the revocation reasons change in the Server Certificate Working Group there is a potential knock-on effect in other working groups, including S/MIME, which mirrored those requirements, and that the S/MIME working group would want to feed into that discussion. He also reported a narrowing under one root program of the guardrails around use of the email protection EKU: where a publicly trusted hierarchy is used for email protection, the leaf certificates must contain an email address and therefore fall automatically within the scope of the S/MIME Baseline Requirements. A discussion has begun on whether the entire scope of the S/MIME Baseline Requirements should be read that way, and on defining which types of Subordinate CA Certificates are automatically pulled into scope. There is an issue open in the S/MIME GitHub. A cleanup ballot is coming shortly with minor changes keeping pace with the TLS working group, which he characterized as non-controversial. Network Security Working Group: Clint Wilson (Apple) was not present. David Kluge (Google Trust Services) gave the update, reporting little change since the last one. The working group is preparing for the face-to-face, where the topics will be the future of the Network and Certificate System Security Requirements and the direction for further improvements, CP/CPS disclosure of the network and certificate system security requirements and how they are implemented, and the adoption of AI for security and audit-related purposes. Definitions and Glossary Working Group: Tim Callan (Sectigo) gave the update on behalf of Polina Glazyrina (Sectigo). A ballot went into a discussion period and received good feedback that the group considered worth taking and addressing. Rather than proceed to a vote on that version, the group will withdraw it and put a revised ballot into a new discussion period. The exact timing is not settled. The working group has been placed on the plenary agenda for the face-to-face so the community can hold an open discussion on its vision for the glossary. Forum Infrastructure Subcommittee: Jos Purvis (Fastly) reported the subcommittee did not meet last week, so there was no update. IPR administration: Ben Wilson (Mozilla) will confirm whether the reminder was sent to members who have not signed version 1.4 of the IPR Agreement, warning that their membership would otherwise be terminated. The outstanding tasks are to update the member tools list of those members and to ensure they are removed from the website. 3. Elections Nominations for the chairs have concluded. Three positions are contested: Forum Chair, Server Certificate Working Group Chair, and Network Security Working Group Chair. Three are uncontested and need only be confirmed: S/MIME Certificate Working Group Chair, Code Signing Certificate Working Group Chair, and Definitions and Glossary Working Group Chair. Tim Callan (Sectigo) reviewed the election timeline. Per the special elections ballot circulated 2026-09-07, the discussion period closes 2026-09-14 at 16:00 UTC, and voting runs from then until 2026-09-21 at 16:00 UTC. Candidates have the option, but not the obligation, to send a message to the list setting out their vision and qualifications; none had done so at the time of the call. 4. Face-to-Face 68, Vienna, Austria, hosted by eMudhra, 2026-09-22 to 2026-09-24 About half a dozen registration spots remain. Final numbers have been given to the venues, but Scott Rea (eMudhra) confirmed sign-ups can stay open for the remaining spots, since not every attendee joins every session. Members who signed up for the social event but can no longer attend, or whose plus one can no longer attend, should notify Scott Rea (eMudhra). Late additions can also be accommodated. Transport has been arranged between the Parliament venue and the Beethoven House, so personal transport is not required. A tour of the Parliament is scheduled for 17:00 on the first day for those who wish to participate. 5. Upcoming Meetings Face-to-Face 69, Scottsdale, Arizona, hosted by Sectigo: 2027-02-23 to 2027-02-25. Dates confirmed. Sign-ups are open on the wiki. Face-to-Face 70, Zurich, Switzerland, hosted by SwissSign: 2027-09-21 to 2027-09-23. Dates newly confirmed. Tim Callan (Sectigo) thanked SwissSign and asked members to mark their calendars. 6. Any Other Business None.
September 10, 2026 by 2026-09-10 Minutes of the ForumMinutes: CA/B Forum Plenary Meeting - September 10, 2026 1. Opening Tim Callan (Sectigo) opened the plenary and the Note Well was read. Dustin Hollenback (Apple) took the minutes. Minutes Approval: Tim Callan (Sectigo) asked whether anyone opposed approval of the minutes of 2026-08-27. Hearing no opposition, those minutes were approved. 2. Working Group Updates Server Certificate Working Group: Dimitris Zacharopoulos (HARICA) reported that the working group had spent most of its previous meeting on reasons for revocation, a discussion led by Ben Wilson (Mozilla), who described a process for establishing why certificates are revoked and what problems revocation is intended to solve. Rather than create a subcommittee or ad hoc group, the working group decided to use the Server Certificate Working Group mailing list with specific subject tags to drive that discussion. The remainder of the time was spent on face-to-face agenda topics. Validation Subcommittee: Stephen Davidson (DigiCert) reported that the subcommittee’s last teleconference went through a series of proposals from Rich Smith (DigiCert) on modernizing aspects of the EV Guidelines, now circulated as a fully formed set of redlines. He noted the redlines went to the Server Certificate Working Group list rather than the Validation Subcommittee list; Rich Smith (DigiCert) confirmed he had intended to send them to validation but that they went to servercert, and he left them there. Stephen Davidson (DigiCert) also reported that discussion has begun, and will continue at the face-to-face and beyond, on the use of AI-based tools in conducting validation. The white paper and presentation materials are on the Validation Subcommittee mailing list. He invited insight from anyone with a view on how AI can be used in support of validation tasks under the CA/Browser Forum standards, on what guardrails should be imposed, and on record-keeping changes that might be advisable when AI is used. Code Signing Certificate Working Group: Martijn Katerbarg (Sectigo) reported the working group started meeting again last week and has mainly planned for the face-to-face. Microsoft gave a short update on threat intelligence sharing, for which they are starting a pilot with a small number of Certification Authorities, with the expectation it will expand over time. Face-to-face topics will include clarifying ambiguous language on the organization name in Code Signing Certificates when combined with an individual Code Signing Certificate, concerns raised about the reuse of private keys and key pairs, and a proposal to align the Code Signing guidelines with the TLS documents on Section 7. S/MIME Certificate Working Group: Stephen Davidson (DigiCert) reported that SMC-018, a ballot realigning the multi-purpose use cases, passed and is in IPR review until 2026-09-24, and encouraged anyone wishing to conduct a review to do so. He noted that if the revocation reasons change in the Server Certificate Working Group there is a potential knock-on effect in other working groups, including S/MIME, which mirrored those requirements, and that the S/MIME working group would want to feed into that discussion. He also reported a narrowing under one root program of the guardrails around use of the email protection EKU: where a publicly trusted hierarchy is used for email protection, the leaf certificates must contain an email address and therefore fall automatically within the scope of the S/MIME Baseline Requirements. A discussion has begun on whether the entire scope of the S/MIME Baseline Requirements should be read that way, and on defining which types of Subordinate CA Certificates are automatically pulled into scope. There is an issue open in the S/MIME GitHub. A cleanup ballot is coming shortly with minor changes keeping pace with the TLS working group, which he characterized as non-controversial. Network Security Working Group: Clint Wilson (Apple) was not present. David Kluge (Google Trust Services) gave the update, reporting little change since the last one. The working group is preparing for the face-to-face, where the topics will be the future of the Network and Certificate System Security Requirements and the direction for further improvements, CP/CPS disclosure of the network and certificate system security requirements and how they are implemented, and the adoption of AI for security and audit-related purposes. Definitions and Glossary Working Group: Tim Callan (Sectigo) gave the update on behalf of Polina Glazyrina (Sectigo). A ballot went into a discussion period and received good feedback that the group considered worth taking and addressing. Rather than proceed to a vote on that version, the group will withdraw it and put a revised ballot into a new discussion period. The exact timing is not settled. The working group has been placed on the plenary agenda for the face-to-face so the community can hold an open discussion on its vision for the glossary. Forum Infrastructure Subcommittee: Jos Purvis (Fastly) reported the subcommittee did not meet last week, so there was no update. IPR administration: Ben Wilson (Mozilla) will confirm whether the reminder was sent to members who have not signed version 1.4 of the IPR Agreement, warning that their membership would otherwise be terminated. The outstanding tasks are to update the member tools list of those members and to ensure they are removed from the website. 3. Elections Nominations for the chairs have concluded. Three positions are contested: Forum Chair, Server Certificate Working Group Chair, and Network Security Working Group Chair. Three are uncontested and need only be confirmed: S/MIME Certificate Working Group Chair, Code Signing Certificate Working Group Chair, and Definitions and Glossary Working Group Chair. Tim Callan (Sectigo) reviewed the election timeline. Per the special elections ballot circulated 2026-09-07, the discussion period closes 2026-09-14 at 16:00 UTC, and voting runs from then until 2026-09-21 at 16:00 UTC. Candidates have the option, but not the obligation, to send a message to the list setting out their vision and qualifications; none had done so at the time of the call. 4. Face-to-Face 68, Vienna, Austria, hosted by eMudhra, 2026-09-22 to 2026-09-24 About half a dozen registration spots remain. Final numbers have been given to the venues, but Scott Rea (eMudhra) confirmed sign-ups can stay open for the remaining spots, since not every attendee joins every session. Members who signed up for the social event but can no longer attend, or whose plus one can no longer attend, should notify Scott Rea (eMudhra). Late additions can also be accommodated. Transport has been arranged between the Parliament venue and the Beethoven House, so personal transport is not required. A tour of the Parliament is scheduled for 17:00 on the first day for those who wish to participate. 5. Upcoming Meetings Face-to-Face 69, Scottsdale, Arizona, hosted by Sectigo: 2027-02-23 to 2027-02-25. Dates confirmed. Sign-ups are open on the wiki. Face-to-Face 70, Zurich, Switzerland, hosted by SwissSign: 2027-09-21 to 2027-09-23. Dates newly confirmed. Tim Callan (Sectigo) thanked SwissSign and asked members to mark their calendars. 6. Any Other Business None.
2026-08-13 Minutes of the Forum
August 13, 2026 by Minutes: CA/B Forum plenary Meeting - August 13, 2026 1. Roll Call – from recording 2. Read note-well Dean Coclin chaired the meeting. The note-well had been read during the immediately preceding Server Certificate Working Group meeting.
August 13, 2026 by Minutes: CA/B Forum plenary Meeting - August 13, 2026 1. Roll Call – from recording 2. Read note-well Dean Coclin chaired the meeting. The note-well had been read during the immediately preceding Server Certificate Working Group meeting.
2026-06-18 Minutes of the Forum
June 18, 2026 by Minutes: CA/B Forum plenary Meeting - June 18, 2026 1. Roll Call – from recording 2. Read note-well The note-well was read by Dimitris in prior session.
June 18, 2026 by Minutes: CA/B Forum plenary Meeting - June 18, 2026 1. Roll Call – from recording 2. Read note-well The note-well was read by Dimitris in prior session.
2026-06-04 Minutes of the Forum
June 4, 2026 by Minutes: Attendees Aaron Gable (Let’s Encrypt), Aaron Poulsen (SSL.com), Adam Folson (IdenTrust), Adriano Santoni (Actalis S.p.A.), Alexandros Afentoulis (HARICA), Alvin Wang (SHECA), Andrea Holland (IdenTrust), Antti Backman (Telia Company), Arman Asemani (Apple), Ben Wilson (Mozilla), Chad Dandar (Cisco Systems), Chris Clements (Google), Clint Wilson (Apple), Cynethia Brown (US Federal PKI Management Authority), Daryn Wright (Apple), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Dustin Hollenback (Apple), Eamon Zhang (TrustAsia), Eleftheria Theologou (HARICA), Enrico Entschew (D-TRUST), Eric Hampshire (Cisco Systems), Georgy Sebastian (Amazon), Grace Cimaszewski (Grace Cimaszewski (Private Person)), Gregory Tomko (GlobalSign), Gurleen Grewal (Google), Hazhar Ismail (MSC Trustgate Sdn Bhd), Henry Birge-Lee (Henry Birge-Lee (Private person)), Hogeun Yoo (NAVER Cloud Trust Services), Inaba Atsushi (GlobalSign), India Donald (US Federal PKI Management Authority), Jan Smith (US Federal PKI Management Authority), Jinhwan Shin (CPA Canada/WebTrust), Joe DeBlasio (Google), John Mason (Microsoft), Johnny Reading (GoDaddy), Joseph Cigin (Joseph Cigin (Private Person)), Jos Purvis (Fastly), Josselin Allemandou (Certigna (DHIMYOTIS)), Jun Okura (Cybertrust Japan), Karina Sirota (Microsoft), Kateryna Aleksieieva (Asseco Data Systems SA (Certum)), Kiran Tummala (Apple), Li-Chun Chen (Chunghwa Telecom), Lilia Dubko (CPA Canada/WebTrust), Lucy Buecking (IdenTrust), Mads Henriksveen (Buypass AS), Mahua Chaudhuri (Microsoft), Marijn Nagelkerke (360 Browser), Mark Gamache (Mark Gamache (Private Person)), Mark Nelson (IdenTrust), Martijn Katerbarg (Sectigo), Masaru Sakamoto (Cybertrust Japan), Masatoshi Shigaki (CPA Canada/WebTrust), Matthew McPherrin (Let’s Encrypt), Michelle Coon (OATI), Mrugesh Chandarana (IdenTrust), Nate Smith (GoDaddy), Nick France (Sectigo), Nome Huang (TrustAsia), Ono Fumiaki (SECOM Trust Systems), Paul van Brouwershaven (Entrust), Paul van Brouwershaven (Digitorus), Pekka Lahtiharju (Telia Company), Peter Miskovic (Disig), Rebecca Kelly (SSL.com), Rob Brady (SGNR, LLC), Rob Stradling (Sectigo), Rob White (GoDaddy), Rollin Yu (TrustAsia), Roman Fischer (SwissSign), Sándor Szőke (Microsec), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Sean Huang (TWCA), Sven Rajala (Keyfactor), Tadahiko Ito (SECOM Trust Systems), Tathan Thacker (IdenTrust), Thomas Connelly (US Federal PKI Management Authority), Thomas Zermeno (SSL.com), Tim Callan (Sectigo), Tim Crawford (CPA Canada/WebTrust), Tobias Josefowitz (Opera Software AS), Trevoli Ponds-White (Amazon), Tsung-Min Kuo (Chunghwa Telecom), Vikas Khanna (Microsoft), Vinay Kumar (OATI), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Zhao Kuisen (NovaVanguard Technology Co., Ltd.)
June 4, 2026 by Minutes: Attendees Aaron Gable (Let’s Encrypt), Aaron Poulsen (SSL.com), Adam Folson (IdenTrust), Adriano Santoni (Actalis S.p.A.), Alexandros Afentoulis (HARICA), Alvin Wang (SHECA), Andrea Holland (IdenTrust), Antti Backman (Telia Company), Arman Asemani (Apple), Ben Wilson (Mozilla), Chad Dandar (Cisco Systems), Chris Clements (Google), Clint Wilson (Apple), Cynethia Brown (US Federal PKI Management Authority), Daryn Wright (Apple), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Dustin Hollenback (Apple), Eamon Zhang (TrustAsia), Eleftheria Theologou (HARICA), Enrico Entschew (D-TRUST), Eric Hampshire (Cisco Systems), Georgy Sebastian (Amazon), Grace Cimaszewski (Grace Cimaszewski (Private Person)), Gregory Tomko (GlobalSign), Gurleen Grewal (Google), Hazhar Ismail (MSC Trustgate Sdn Bhd), Henry Birge-Lee (Henry Birge-Lee (Private person)), Hogeun Yoo (NAVER Cloud Trust Services), Inaba Atsushi (GlobalSign), India Donald (US Federal PKI Management Authority), Jan Smith (US Federal PKI Management Authority), Jinhwan Shin (CPA Canada/WebTrust), Joe DeBlasio (Google), John Mason (Microsoft), Johnny Reading (GoDaddy), Joseph Cigin (Joseph Cigin (Private Person)), Jos Purvis (Fastly), Josselin Allemandou (Certigna (DHIMYOTIS)), Jun Okura (Cybertrust Japan), Karina Sirota (Microsoft), Kateryna Aleksieieva (Asseco Data Systems SA (Certum)), Kiran Tummala (Apple), Li-Chun Chen (Chunghwa Telecom), Lilia Dubko (CPA Canada/WebTrust), Lucy Buecking (IdenTrust), Mads Henriksveen (Buypass AS), Mahua Chaudhuri (Microsoft), Marijn Nagelkerke (360 Browser), Mark Gamache (Mark Gamache (Private Person)), Mark Nelson (IdenTrust), Martijn Katerbarg (Sectigo), Masaru Sakamoto (Cybertrust Japan), Masatoshi Shigaki (CPA Canada/WebTrust), Matthew McPherrin (Let’s Encrypt), Michelle Coon (OATI), Mrugesh Chandarana (IdenTrust), Nate Smith (GoDaddy), Nick France (Sectigo), Nome Huang (TrustAsia), Ono Fumiaki (SECOM Trust Systems), Paul van Brouwershaven (Entrust), Paul van Brouwershaven (Digitorus), Pekka Lahtiharju (Telia Company), Peter Miskovic (Disig), Rebecca Kelly (SSL.com), Rob Brady (SGNR, LLC), Rob Stradling (Sectigo), Rob White (GoDaddy), Rollin Yu (TrustAsia), Roman Fischer (SwissSign), Sándor Szőke (Microsec), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Sean Huang (TWCA), Sven Rajala (Keyfactor), Tadahiko Ito (SECOM Trust Systems), Tathan Thacker (IdenTrust), Thomas Connelly (US Federal PKI Management Authority), Thomas Zermeno (SSL.com), Tim Callan (Sectigo), Tim Crawford (CPA Canada/WebTrust), Tobias Josefowitz (Opera Software AS), Trevoli Ponds-White (Amazon), Tsung-Min Kuo (Chunghwa Telecom), Vikas Khanna (Microsoft), Vinay Kumar (OATI), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Zhao Kuisen (NovaVanguard Technology Co., Ltd.)
2026-05-21 Minutes of the Forum
May 21, 2026 by Minutes: Meeting Metadata Meeting Title: CA/Browser Forum Date: 21 May 2026 Chair: Dimitris Zacharopoulos Minutes Taken By: Wayne Thayer 1. Begin Recording - Roll Call 2. Reading of Note-well The Note-Well was read
May 21, 2026 by Minutes: Meeting Metadata Meeting Title: CA/Browser Forum Date: 21 May 2026 Chair: Dimitris Zacharopoulos Minutes Taken By: Wayne Thayer 1. Begin Recording - Roll Call 2. Reading of Note-well The Note-Well was read
2026-05-07 Minutes of the Forum
May 7, 2026 by Minutes: 1. Begin Recording - Roll Call 2. Reading of Note-well The Note-Well was read
May 7, 2026 by Minutes: 1. Begin Recording - Roll Call 2. Reading of Note-well The Note-Well was read
2026-04-23 Minutes of the Forum
April 23, 2026 by Minutes: Final Minutes for CA/B Forum Plenary Meeting - April 23, 2026 Attendees Aaron Gable (ISRG), Adam Folsom (IdenTrust), Antti Backman (Telia Company), Antti Backman (Telia Company), Antti Backman (Telia Company), Antti Backman (Telia Company), Atsushi INABA (GlobalSign), Ben Wilson (Mozilla), Benjamin (ChungHwa Telecom), Chris Clements (Google Chrome), Clint Wilson (Apple), Corey Bonnell (DigiCert), Daryn Wright (Apple), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Dustin Hollenback (Apple), Enrico Entschew (D-Trust), Greg Tomko (GlobalSign), Gurleen Grewal (GTS), Hazhar Ismail (MSC Trustgate), Hogeun Yoo (NAVER Cloud Trust Services), Inigo Barreira (Sectigo), Jaime Hablutzel (WISekey), Janet Hines (SSL.com), Jeff Ward (Aprio), Johnny Reading (GoDaddy), Jos Purvis (Fastly), Jun Okura (Cybertrust), Karolina Ruszczynska (Certum), Kateryna Aleksieieva (Certum by Asseco), Lilia Dubko (CPA Canada), Lucy Buecking (IdenTrust), Luis Osses (Amazon Trust Services), Mahua Chaudhuri (Microsoft), Martijn Katerbarg (Sectigo), Matthew McPherrin (ISRG), Michelle Coon (OATI), Mrugesh Chandarana (IdenTrust), Nate Smith (GoDaddy), Nome Huang (TrustAsia), ONO Fumiaki (SECOM), Peter Miskovic (Disig), Rob White (GoDaddy), Rollin Yu (TrustAsia), Roman Fischer (SwissSign), Sándor Szöke (Microsec), Scott Rea (eMudhra), Sean Huang (TWCA), Stephen Davidson (DigiCert), Tadahiko ITO (SECOM), Thomas Zermeno (SSL.com), Tim Callan (Sectigo), Tobias Josefowitz (Opera), Trevoli Ponds-White (Amazon Trust Services), Tsung-Min Kuo (Chunghwa Telecom), Wayne Thayer (Fastly)
April 23, 2026 by Minutes: Final Minutes for CA/B Forum Plenary Meeting - April 23, 2026 Attendees Aaron Gable (ISRG), Adam Folsom (IdenTrust), Antti Backman (Telia Company), Antti Backman (Telia Company), Antti Backman (Telia Company), Antti Backman (Telia Company), Atsushi INABA (GlobalSign), Ben Wilson (Mozilla), Benjamin (ChungHwa Telecom), Chris Clements (Google Chrome), Clint Wilson (Apple), Corey Bonnell (DigiCert), Daryn Wright (Apple), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Dustin Hollenback (Apple), Enrico Entschew (D-Trust), Greg Tomko (GlobalSign), Gurleen Grewal (GTS), Hazhar Ismail (MSC Trustgate), Hogeun Yoo (NAVER Cloud Trust Services), Inigo Barreira (Sectigo), Jaime Hablutzel (WISekey), Janet Hines (SSL.com), Jeff Ward (Aprio), Johnny Reading (GoDaddy), Jos Purvis (Fastly), Jun Okura (Cybertrust), Karolina Ruszczynska (Certum), Kateryna Aleksieieva (Certum by Asseco), Lilia Dubko (CPA Canada), Lucy Buecking (IdenTrust), Luis Osses (Amazon Trust Services), Mahua Chaudhuri (Microsoft), Martijn Katerbarg (Sectigo), Matthew McPherrin (ISRG), Michelle Coon (OATI), Mrugesh Chandarana (IdenTrust), Nate Smith (GoDaddy), Nome Huang (TrustAsia), ONO Fumiaki (SECOM), Peter Miskovic (Disig), Rob White (GoDaddy), Rollin Yu (TrustAsia), Roman Fischer (SwissSign), Sándor Szöke (Microsec), Scott Rea (eMudhra), Sean Huang (TWCA), Stephen Davidson (DigiCert), Tadahiko ITO (SECOM), Thomas Zermeno (SSL.com), Tim Callan (Sectigo), Tobias Josefowitz (Opera), Trevoli Ponds-White (Amazon Trust Services), Tsung-Min Kuo (Chunghwa Telecom), Wayne Thayer (Fastly)
2026-04-09 Minutes of the Forum
April 9, 2026 by Minutes: Attendees Tadahiko ITO-SECOM, Wayne Thayer, Luis Cervantes (SSL.com), Luis Osses (Amazon Trust Services), Mahua Chaudhuri (Microsoft), Sandy Balzer - SwissSign, Michael Slaughter (Amazon Trust Services), Sean Huang (TWCA), Janet Hines - SSL.com, Rebecca Kelley - SSL, Karolina Ruszczynska - Certum, Greg Tomko (GlobalSign), Jozef Nigut - Disig, Sándor SZŐKE, dr. (Microsec), Enrico Entschew/ D-Trust, Ben Wilson - Mozilla, Adam Folsom, Dustin Hollenback, Kateryna Aleksieieva (Certum by Asseco), Tobias Josefowitz (Opera), Inigo Barreira, Jos Purvis (Fastly), Dean, Trevoli Ponds-White [Amazon Trust Services], wendy brown - FPKIMA, Stephen Davidson (DigiCert), Peter Miskovic - Disig, Scott Rea - eMudhra, Roman Fischer - SwissSign, Paul van Brouwershaven (Digitorus), [WISeKey] Jaime Hablutzel, Rich Smith (DigiCert), Aaron Gable (ISRG), Steven Deitte - GoDaddy, Lucy Buecking - IdenTrust, Nome Huang-TrustAsia, Chad Dandar, Atsushi INABA - GlobalSign, Hogeun Yoo - NAVER Cloud Trust Services, Clint Wilson, Corey Bonnell [DigiCert], ONO Fumiaki - SECOM Trust Systems, Nate Smith - GoDaddy, Jeff Ward (Aprio), Georgy Sebastian(AWS), Lilia Dubko, Cynetheia Brown(FPKIMA), Rollin Yu - TrustAsia, Alvin.Wang(SHECA), Antti Backman - Telia Company, Tim Callan (Sectigo), Chunghwa Telecom / Tsung-Min Kuo
April 9, 2026 by Minutes: Attendees Tadahiko ITO-SECOM, Wayne Thayer, Luis Cervantes (SSL.com), Luis Osses (Amazon Trust Services), Mahua Chaudhuri (Microsoft), Sandy Balzer - SwissSign, Michael Slaughter (Amazon Trust Services), Sean Huang (TWCA), Janet Hines - SSL.com, Rebecca Kelley - SSL, Karolina Ruszczynska - Certum, Greg Tomko (GlobalSign), Jozef Nigut - Disig, Sándor SZŐKE, dr. (Microsec), Enrico Entschew/ D-Trust, Ben Wilson - Mozilla, Adam Folsom, Dustin Hollenback, Kateryna Aleksieieva (Certum by Asseco), Tobias Josefowitz (Opera), Inigo Barreira, Jos Purvis (Fastly), Dean, Trevoli Ponds-White [Amazon Trust Services], wendy brown - FPKIMA, Stephen Davidson (DigiCert), Peter Miskovic - Disig, Scott Rea - eMudhra, Roman Fischer - SwissSign, Paul van Brouwershaven (Digitorus), [WISeKey] Jaime Hablutzel, Rich Smith (DigiCert), Aaron Gable (ISRG), Steven Deitte - GoDaddy, Lucy Buecking - IdenTrust, Nome Huang-TrustAsia, Chad Dandar, Atsushi INABA - GlobalSign, Hogeun Yoo - NAVER Cloud Trust Services, Clint Wilson, Corey Bonnell [DigiCert], ONO Fumiaki - SECOM Trust Systems, Nate Smith - GoDaddy, Jeff Ward (Aprio), Georgy Sebastian(AWS), Lilia Dubko, Cynetheia Brown(FPKIMA), Rollin Yu - TrustAsia, Alvin.Wang(SHECA), Antti Backman - Telia Company, Tim Callan (Sectigo), Chunghwa Telecom / Tsung-Min Kuo
Ballot FORUM-037 – Adopt IPR Policy v. 1.4 and Associated Documents
April 9, 2026 by Ballot FORUM-037 - Adopt IPR Policy v. 1.4 and Associated Documents Voting Results The voting period for Forum-037 Adopt IPR Policy v1.4 and Associated Documents has completed. The ballot has: PASSED
April 9, 2026 by Ballot FORUM-037 - Adopt IPR Policy v. 1.4 and Associated Documents Voting Results The voting period for Forum-037 Adopt IPR Policy v1.4 and Associated Documents has completed. The ballot has: PASSED
2026-03-26 Minutes of the Forum
March 26, 2026 by Minutes: CA/B Forum plenary Meeting - March 26, 2026 Minutes Begin Recording - Roll Call Recording started Read note-well Read the note-well at SCWG prior Review of Agenda No changes Approval of minutes February 26th (Martijn) - (Draft minutes have not been distributed yet) Please submit F2F minutes on Etherpad. Server Certificate Working Group update (Dimitris) Went over face-to-face agenda and ballot updates at 02/26 meeting Face-to-face minutes are being compiled yet Capturing BR version at DCV time. Working Group opined that requirement should be replaced with something else - Aaron Gable to propose the change (aligned with expectations of: Proper documentation, accountability, change management). CP/CPS Content Consistency - gave examples where they were vague vs explicit. More explicit leads to more chances of falling into non-compliance and having to revoke. Captured the CA/B Forum expectations and how to proceed forward with improvements. Revocation Timelines and CP/CPS consistency - alternative proposal to have CAs document which areas are allowed to have more flexibility and have a different revocation timeline (or no revocation at all as long as it is stricter than the BRs) - will be sent in F2F minutes. Availability of resources such as CRL distribution points; repository; OCSP URLs; etc. Rules are vague now. CAs might implement settings to prevent abuse and DOS attacks (geolocation blocking, etc). Feedback to be captured in F2F meeting minutes and then see what next steps are based on that feedback. Validation Subcommittee - Corey Bonnell ADN Ballot updates - Reached consensus, ballot should be about ready to go after some minor updates. Scott Rae presented on making more concrete guidance on Reliable Data Sources. Scott to create draft ballot proposal. DNSSEC - whether or not you have to check whether or not domain zone was secured with DNSSEC if one of the domain’s parents was not. If you know the parent was not, you do not have to check the child because you know it was not. May be ballot language drafted for this. Code Signing Certificate Working Group update (Martijn) Face-to-Face presentation by Karina for Microsoft’s vision for code-signing working group and ecosystem. Proposals to make it more available for individual developers and make it open source as well. Increase strength for authentication validation and remove human factor. S/MIME Certificate Working Group update (Stephen) SMC015 MDL Ballot will come out of IPR 03/27/2026. New SMIME BR to be posted after. SMC016 Equivalence Ballot with SCWG now in voting through next week. Ongoing discussion on two items Moving forward with a ballot to increase the minimum RSA key size for SMIME Sub-CAs - draft link is out. Potential changes to Root Program policies and how those impact SMIME BRs or SMIME CAs and what they may need to do going forward. Included in SMIME meeting minutes. NetSec Working Group update (Clint) Met Tuesday, 03/24. NetSec Modernization Work - Determined Miguel will work on proposal for first steps of modernization effort. Cloud Services Logging/Infrastructure use - CoreyB to update his proposal for next meeting in two weeks. Definitions and Glossary Working Group (Tim H.) No Update. Forum Infrastructure Subcommittee update (Jos) Ben Wilson provided update: Updating text of CA/B Forum website - request for volunteers. IPR Subcommittee (Ben) Received call from member of IPR Review Subcommittee - section 4.5 of IPR Policy and new participants and whether they had the rights to raise historic claims or not. Ben reviewing to ensure proper response. If no change, will close discussion on 03/31. if changes needed, will release version 2 for 7 day review period. Let Ben know of comments so he can batch it at the same time. Any Other Business F2F Meeting Schedule: 2026 Vienna, Austria - September 22-24 - eMuhdra (Location to be confirmed) Registration is open on website now 2027 Scottsdale, AZ - Spring 2027 - Sectigo Switzerland - Fall 2027 - SwissSign 2028 Shanghai, China - Spring 2028 - TrustAsia (tentative) Thessaloniki, GR (or Identrust) - Fall 2028 - HARICA (tentative) or Identrust Next call April 9th
March 26, 2026 by Minutes: CA/B Forum plenary Meeting - March 26, 2026 Minutes Begin Recording - Roll Call Recording started Read note-well Read the note-well at SCWG prior Review of Agenda No changes Approval of minutes February 26th (Martijn) - (Draft minutes have not been distributed yet) Please submit F2F minutes on Etherpad. Server Certificate Working Group update (Dimitris) Went over face-to-face agenda and ballot updates at 02/26 meeting Face-to-face minutes are being compiled yet Capturing BR version at DCV time. Working Group opined that requirement should be replaced with something else - Aaron Gable to propose the change (aligned with expectations of: Proper documentation, accountability, change management). CP/CPS Content Consistency - gave examples where they were vague vs explicit. More explicit leads to more chances of falling into non-compliance and having to revoke. Captured the CA/B Forum expectations and how to proceed forward with improvements. Revocation Timelines and CP/CPS consistency - alternative proposal to have CAs document which areas are allowed to have more flexibility and have a different revocation timeline (or no revocation at all as long as it is stricter than the BRs) - will be sent in F2F minutes. Availability of resources such as CRL distribution points; repository; OCSP URLs; etc. Rules are vague now. CAs might implement settings to prevent abuse and DOS attacks (geolocation blocking, etc). Feedback to be captured in F2F meeting minutes and then see what next steps are based on that feedback. Validation Subcommittee - Corey Bonnell ADN Ballot updates - Reached consensus, ballot should be about ready to go after some minor updates. Scott Rae presented on making more concrete guidance on Reliable Data Sources. Scott to create draft ballot proposal. DNSSEC - whether or not you have to check whether or not domain zone was secured with DNSSEC if one of the domain’s parents was not. If you know the parent was not, you do not have to check the child because you know it was not. May be ballot language drafted for this. Code Signing Certificate Working Group update (Martijn) Face-to-Face presentation by Karina for Microsoft’s vision for code-signing working group and ecosystem. Proposals to make it more available for individual developers and make it open source as well. Increase strength for authentication validation and remove human factor. S/MIME Certificate Working Group update (Stephen) SMC015 MDL Ballot will come out of IPR 03/27/2026. New SMIME BR to be posted after. SMC016 Equivalence Ballot with SCWG now in voting through next week. Ongoing discussion on two items Moving forward with a ballot to increase the minimum RSA key size for SMIME Sub-CAs - draft link is out. Potential changes to Root Program policies and how those impact SMIME BRs or SMIME CAs and what they may need to do going forward. Included in SMIME meeting minutes. NetSec Working Group update (Clint) Met Tuesday, 03/24. NetSec Modernization Work - Determined Miguel will work on proposal for first steps of modernization effort. Cloud Services Logging/Infrastructure use - CoreyB to update his proposal for next meeting in two weeks. Definitions and Glossary Working Group (Tim H.) No Update. Forum Infrastructure Subcommittee update (Jos) Ben Wilson provided update: Updating text of CA/B Forum website - request for volunteers. IPR Subcommittee (Ben) Received call from member of IPR Review Subcommittee - section 4.5 of IPR Policy and new participants and whether they had the rights to raise historic claims or not. Ben reviewing to ensure proper response. If no change, will close discussion on 03/31. if changes needed, will release version 2 for 7 day review period. Let Ben know of comments so he can batch it at the same time. Any Other Business F2F Meeting Schedule: 2026 Vienna, Austria - September 22-24 - eMuhdra (Location to be confirmed) Registration is open on website now 2027 Scottsdale, AZ - Spring 2027 - Sectigo Switzerland - Fall 2027 - SwissSign 2028 Shanghai, China - Spring 2028 - TrustAsia (tentative) Thessaloniki, GR (or Identrust) - Fall 2028 - HARICA (tentative) or Identrust Next call April 9th