Voting Period Begins SC-100: DNSSEC Clarification and Consolidation

[Rich Smith]

Ballot SC-100: DNSSEC Clarification and Consolidation

--- Ballot Background ---

Discussion prior to, and at CA/Browser Forum Face to Face Meeting #67 in Houston, TX revealed that there was some lack of clarity regarding the DNSSEC validation requirements, particularly in the area of Remote Network Perspectives, as well as the fact that the DNSSEC validation requirements being somewhat scattered throughout Section 3.2.2 made it more difficult to pin down than it could be if all in one place.

--- Ballot Summary ---

Move all DNSSEC validation requirements to the new Section 4.2.2.2.

Reorganize the structure somewhat for easier reading and reduction of repetition.

Clarify that DNSSEC validation MAY be performed on Remote Network Perspectives, but is REQUIRED only on the Primary Network Perspective.

This ballot does not currently have an effective date, as the intent is merely to address clarity and there is no intention to modify the existing requirements

This ballot is proposed by Rich Smith (DigiCert) and endorsed by Trev Ponds-White (Amazon) and Scott Rea (eMudhra)

 

--- Motion Begins ---

 

Modify the "Baseline Requirements for the Issuance and Management of Publicly-Trusted Server Certificates", based on Version 2.2.8, per the following redline:

 

https://github.com/cabforum/servercert/compare/9270ad7887b48d58bf0954336de32c265a934d66...b6dd09f33c3ef9a88672332faca3c4cbcb391276

 

--- Motion Ends ---

 

This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:

 

Discussion (COMPLETE):

· Start time: 2026-06-30 17:00 UTC

· End time: 2026-07-30 17:00 UTC

Vote for approval (7 days):

· Start time: 2026-07-30 17:00 UTC

· End time: 2026-08-06 17:00 UTC

 

 

Rich Smith

Sr. Director, Product Technical Excellence

 

 

[Michael Guenther]

SwissSign votes 'yes' on ballot SC-100

 

Mike

--
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/IA0PR14MB64146FC191C5C949EDBDAF11E3C92%40IA0PR14MB6414.namprd14.prod.outlook.com.

[黃晟(orca)]

TWCA votes Yes on Ballot SC-100.

 

Best,

 

Sean Huang

Senior PKI Compliance Engineer
TEL：02-2370-8886#728
FAX：02-2388-6720
Email：or...@twca.com.tw

10F., No. 85, Yanping South Road,

Taipei, Taiwan (R.O.C.)

 

 

 

 

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Friday, July 31, 2026 1:01 AM
To: server...@groups.cabforum.org

--

[Hogeun Yoo]

NAVER Cloud Trust Services votes "Yes" on Ballot SC-100.

Regards,

Hogeun Yoo

2026년 7월 31일 금요일 오전 2시 0분 50초 UTC+9에 Rich Smith님이 작성:

[Tugba ÖZCAN (BILGEM KSM)]

Kamu SM votes Yes on Ballot SC-100.

   

 

Tuğba ÖZCAN
TÜBİTAK BİLGEM

Kamu Sertifikasyon Merkezi/E-İmza Teknolojileri Birim Yöneticisi

tugba...@tubitak.gov.tr, +90 262 648 18 18 - 8543

bilgem.tubitak.gov.tr | Sorumluluk Reddi                 

   

---

Kimden: "'Rich Smith' via Server Certificate WG (CA/B Forum)" <server...@groups.cabforum.org>
Kime: "servercert-wg" <server...@groups.cabforum.org>
Gönderilenler: 30 Temmuz Perşembe 2026 20:00:41
Konu: [Servercert-wg] Voting Period Begins SC-100: DNSSEC Clarification and Consolidation

⚠ Kurum Dışı E-posta!!! Bu e-posta TÜBİTAK dışından gönderilmiştir. Gönderenin kimliğinden emin değilseniz ekleri açmayınız, bağlantılara tıklamayınız ve kişisel bilgilerinizi paylaşmayınız. Şüpheli olduğunu düşündüğünüz e-postaları Oltalama Raporlama Sistemi üzerinden raporlayabilirsiniz.

--

[Kateryna Aleksieieva]

Certum votes YES on Ballot SC-100

 

Kind regards,

Kateryna Aleksieieva

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Thursday, July 30, 2026 7:01 PM

--

[Backman, Antti]

Hi, 

Telia votes ‘Yes’ on Ballot SC-100

//Antti

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Date: Thursday, 30. July 2026 at 20.00
To: server...@groups.cabforum.org <server...@groups.cabforum.org>
Subject: [Servercert-wg] Voting Period Begins SC-100: DNSSEC Clarification and Consolidation

Caution: This is an external email. Stop, assess and verify. Please take care when clicking links or opening attachments! When in doubt, report it using “report phishing” function.

--

[Alvin Wang]

SHECA votes "Yes" on Ballot SC-100.

Best,

Alvin Wang

[Pedro FUENTES]

OISTE Votes Yes to SC-100

<image001.png>

 

-- 
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/IA0PR14MB64146FC191C5C949EDBDAF11E3C92%40IA0PR14MB6414.namprd14.prod.outlook.com.

WISeKey SA

Pedro Fuentes
CSO - Trust Services Manager
Office: + 41 (0) 22 594 30 00
Mobile: + 41 (0) 791 274 790

Address: Avenue Louis-Casaï 58 | 1216 Cointrin | Switzerland

Stay connected with WISeKey

THIS IS A TRUSTED MAIL: This message is digitally signed with a WISeKey identity. If you get a mail from WISeKey please check the signature to avoid security risks

CONFIDENTIALITY: This email and any files transmitted with it can be confidential and it’s intended solely for the use of the individual or entity to which they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. If you have received this email in error please notify the sender

DISCLAIMER: WISeKey does not warrant the accuracy or completeness of this message and does not accept any liability for any errors or omissions herein as this message has been transmitted over a public network. Internet communications cannot be guaranteed to be secure or error-free as information may be intercepted, corrupted, or contain viruses. Attachments to this e-mail are checked for viruses; however, we do not accept any liability for any damage sustained by viruses and therefore you are kindly requested to check for viruses upon receipt.

[Ben Wilson]

Mozilla votes yes on Ballot SC-100

--

[Peter Miškovič]

Disig votes „YES“ on Ballot SC-100: DNSSEC Clarification and Consolidation.

 

Regards,

Peter Miskovic

--

[Scott Rea]

eMudhra votes YES on Ballot SC-100

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Date: Thursday, 30 July 2026 at 11:00 AM
To: server...@groups.cabforum.org <server...@groups.cabforum.org>
Subject: [Servercert-wg] Voting Period Begins SC-100: DNSSEC Clarification and Consolidation

CAUTION: This email is originated from outside of the organization. Do not open the links or the attachments unless you recognize the sender and know the content is safe.

--

You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/IA0PR14MB64146FC191C5C949EDBDAF11E3C92%40IA0PR14MB6414.namprd14.prod.outlook.com.

Disclaimer: The email and its contents hold confidential information and are intended for the person or entity to which it is addressed. If you are not the intended recipient, please note that any distribution or copying of this email is strictly prohibited as per Company Policy, you are requested to notify the sender and delete the email and associated attachments with it from your system.

[Dustin Hollenback]

Apple votes “Yes” on SC-100.

<image001.png>

 

--
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/IA0PR14MB64146FC191C5C949EDBDAF11E3C92%40IA0PR14MB6414.namprd14.prod.outlook.com.

Disclaimer: The email and its contents hold confidential information and are intended for the person or entity to which it is addressed. If you are not the intended recipient, please note that any distribution or copying of this email is strictly prohibited as per Company Policy, you are requested to notify the sender and delete the email and associated attachments with it from your system.

--
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/KL1PR0401MB5017B44512B59ABD77C0B981F0D42%40KL1PR0401MB5017.apcprd04.prod.outlook.com.

[Dimitris Zacharopoulos]

HARICA votes "yes" to ballot SC100.

Jul 30, 2026 20:00:56 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>:

Ballot SC-100: DNSSEC Clarification and Consolidation

--- Ballot Background ---

Discussion prior to, and at CA/Browser Forum Face to Face Meeting #67 in Houston, TX revealed that there was some lack of clarity regarding the DNSSEC validation requirements, particularly in the area of Remote Network Perspectives, as well as the fact that the DNSSEC validation requirements being somewhat scattered throughout Section 3.2.2 made it more difficult to pin down than it could be if all in one place.

--- Ballot Summary ---

Move all DNSSEC validation requirements to the new Section 4.2.2.2.

Reorganize the structure somewhat for easier reading and reduction of repetition.

Clarify that DNSSEC validation MAY be performed on Remote Network Perspectives, but is REQUIRED only on the Primary Network Perspective.

This ballot does not currently have an effective date, as the intent is merely to address clarity and there is no intention to modify the existing requirements

This ballot is proposed by Rich Smith (DigiCert) and endorsed by Trev Ponds-White (Amazon) and Scott Rea (eMudhra)
 

--- Motion Begins ---
 

Modify the "Baseline Requirements for the Issuance and Management of Publicly-Trusted Server Certificates", based on Version 2.2.8, per the following redline:
 

https://github.com/cabforum/servercert/compare/9270ad7887b48d58bf0954336de32c265a934d66...b6dd09f33c3ef9a88672332faca3c4cbcb391276
 

--- Motion Ends ---
 

This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:
 

Discussion (COMPLETE):
· Start time: 2026-06-30 17:00 UTC
· End time: 2026-07-30 17:00 UTC
Vote for approval (7 days):
· Start time: 2026-07-30 17:00 UTC
· End time: 2026-08-06 17:00 UTC
 

 

Rich Smith
Sr. Director, Product Technical Excellence
 

[大野文彰（ONO Fumiaki）]

SECOM Trust Systems votes YES on Ballot SC-100.

Best regards,

ONO Fumiaki / 大野 文彰
(Japanese name order; family name in uppercase)
SECOM Trust Systems CO., LTD.

2026年7月31日金曜日 2:00:50 UTC+9 Rich Smith:

[jun....@cybertrust.co.jp]

Cybertrust Japan votes Yes on Ballot SC-100

-----Original Message-----
From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Friday, July 31, 2026 2:01 AM
To: server...@groups.cabforum.org
Subject: [Servercert-wg] Voting Period Begins SC-100: DNSSEC Clarification and Consolidation

Ballot SC-100: DNSSEC Clarification and Consolidation

--- Ballot Background ---

Discussion prior to, and at CA/Browser Forum Face to Face Meeting #67 in Houston, TX revealed that there was some lack of clarity regarding the DNSSEC validation requirements, particularly in the area of Remote Network Perspectives, as well as the fact that the DNSSEC validation requirements being somewhat scattered throughout Section 3.2.2 made it more difficult to pin down than it could be if all in one place.

--- Ballot Summary ---

Move all DNSSEC validation requirements to the new Section 4.2.2.2.

Reorganize the structure somewhat for easier reading and reduction of repetition.

Clarify that DNSSEC validation MAY be performed on Remote Network Perspectives, but is REQUIRED only on the Primary Network Perspective.

This ballot does not currently have an effective date, as the intent is merely to address clarity and there is no intention to modify the existing requirements

This ballot is proposed by Rich Smith (DigiCert) and endorsed by Trev Ponds-White (Amazon) and Scott Rea (eMudhra)



--- Motion Begins ---



Modify the "Baseline Requirements for the Issuance and Management of Publicly-Trusted Server Certificates", based on Version 2.2.8, per the following redline:

https://github.com/cabforum/servercert/compare/9270ad7887b48d58bf0954336de32c265a934d66...b6dd09f33c3ef9a88672332faca3c4cbcb391276 <https://url.avanan.click/v2/r01/___https:/github.com/cabforum/servercert/compare/9270ad7887b48d58bf0954336de32c265a934d66...b6dd09f33c3ef9a88672332faca3c4cbcb391276___.YXAzOmRpZ2ljZXJ0OmE6bzo3MjI2ZjczOTBhYzM2YzExYmI4OGM1MWM0NjUxZWEyMjo3OjM4MjI6Y2RmOWExNWExMTdjNzIxNDY3MDFhYWJjMmY5ZWMyNzI5MmU2YjQ0OWIxYjgzYjE5MGUyZDY0MjQ3MjYxZTViMzpoOlQ6Rg>

--- Motion Ends ---



This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:



Discussion (COMPLETE):

* Start time: 2026-06-30 17:00 UTC

* End time: 2026-07-30 17:00 UTC

Vote for approval (7 days):

* Start time: 2026-07-30 17:00 UTC

* End time: 2026-08-06 17:00 UTC

Rich Smith

Sr. Director, Product Technical Excellence

--
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org <mailto:servercert-w...@groups.cabforum.org> .
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/IA0PR14MB64146FC191C5C949EDBDAF11E3C92%40IA0PR14MB6414.namprd14.prod.outlook.com <https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/IA0PR14MB64146FC191C5C949EDBDAF11E3C92%40IA0PR14MB6414.namprd14.prod.outlook.com?utm_medium=email&utm_source=footer> .

[郭宗閔]

Chunghwa Telecom votes "yes" to ballot SC100.

 

 

Regards,

Tsung-Min Kuo

Chunghwa Telecom Co., Ltd., Taiwan (R.O.C.)

 

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Friday, July 31, 2026 1:01 AM
To: server...@groups.cabforum.org

Subject: [外部郵件][Servercert-wg] Voting Period Begins SC-100: DNSSEC Clarification and Consolidation

--

You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/IA0PR14MB64146FC191C5C949EDBDAF11E3C92%40IA0PR14MB6414.namprd14.prod.outlook.com.

本信件可能包含中華電信股份有限公司機密資訊,非指定之收件者,請勿蒐集、處理或利用本信件內容,並請銷毀此信件. 如為指定收件者,應確實保護郵件中本公司之營業機密及個人資料,不得任意傳佈或揭露,並應自行確認本郵件之附檔與超連結之安全性,以共同善盡資訊安全與個資保護責任.
Please be advised that this email message (including any attachments) contains confidential information and may be legally privileged. If you are not the intended recipient, please destroy this message and all attachments from your system and do not further collect, process, or use them. Chunghwa Telecom and all its subsidiaries and associated companies shall not be liable for the improper or incomplete transmission of the information contained in this email nor for any delay in its receipt or damage to your system. If you are the intended recipient, please protect the confidential and/or personal information contained in this email with due care. Any unauthorized use, disclosure or distribution of this message in whole or in part is strictly prohibited. Also, please self-inspect attachments and hyperlinks contained in this email to ensure the information security and to protect personal information.

[Nome Huang]

TrustAsia votes "Yes" on Ballot SC-100.

On Friday, July 31, 2026 at 1:00:50 AM UTC+8 Rich Smith wrote:

[qi_ji...@itrus.com.cn]

iTrusChina votes "Yes" on Ballot SC-100.

 

From: 'Rich Smith' via Server Certificate WG (CA/B Forum)

Date: 2026-07-31 01:00

To: server...@groups.cabforum.org

--

[Michael Stone]

CFCA votes Yes on Ballot SC-100.

[Chad Dandar (cdandar)]

Cisco votes "yes" to ballot SC100.

 

Chad Dandar

Cisco

 

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Thursday, July 30, 2026 10:01 AM
To: server...@groups.cabforum.org

--

[Tim Hollebeek]

DigiCert votes YES on SC-100.

-Tim

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/CY8PR11MB700941E74BAB643378701E05BFD32%40CY8PR11MB7009.namprd11.prod.outlook.com.

[Andrea Holland]

IdenTrust votes Yes on SC-100

 

Sincerely,

Andrea Holland

 

 

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Thursday, July 30, 2026 1:01 PM
To: server...@groups.cabforum.org

--

[Wayne Thayer]

Fastly votes Yes on ballot SC-100.

- Wayne

--

[Yoshihiko Matsuo]

JPRS votes YES on Ballot SC-100.

Yoshihiko Matsuo(JPRS)


On Thu, 30 Jul 2026 17:00:41 +0000

"'Rich Smith' via Server Certificate WG (CA/B Forum)" <server...@groups.cabforum.org> wrote:

> Ballot SC-100: DNSSEC Clarification and Consolidation
>
> --- Ballot Background ---
>
> Discussion prior to, and at CA/Browser Forum Face to Face Meeting #67 in Houston, TX revealed that there was some lack of clarity regarding the DNSSEC validation requirements, particularly in the area of Remote Network Perspectives, as well as the fact that the DNSSEC validation requirements being somewhat scattered throughout Section 3.2.2 made it more difficult to pin down than it could be if all in one place.
>
> --- Ballot Summary ---
>
> Move all DNSSEC validation requirements to the new Section 4.2.2.2.
>
> Reorganize the structure somewhat for easier reading and reduction of repetition.
>
> Clarify that DNSSEC validation MAY be performed on Remote Network Perspectives, but is REQUIRED only on the Primary Network Perspective.
>
> This ballot does not currently have an effective date, as the intent is merely to address clarity and there is no intention to modify the existing requirements
>
> This ballot is proposed by Rich Smith (DigiCert) and endorsed by Trev Ponds-White (Amazon) and Scott Rea (eMudhra)
>
>
> --- Motion Begins ---
>
> Modify the "Baseline Requirements for the Issuance and Management of Publicly-Trusted Server Certificates", based on Version 2.2.8, per the following redline:
>

> https://github.com/cabforum/servercert/compare/9270ad7887b48d58bf0954336de32c265a934d66...b6dd09f33c3ef9a88672332faca3c4cbcb391276<https://url.avanan.click/v2/r01/___https:/github.com/cabforum/servercert/compare/9270ad7887b48d58bf0954336de32c265a934d66...b6dd09f33c3ef9a88672332faca3c4cbcb391276___.YXAzOmRpZ2ljZXJ0OmE6bzo3MjI2ZjczOTBhYzM2YzExYmI4OGM1MWM0NjUxZWEyMjo3OjM4MjI6Y2RmOWExNWExMTdjNzIxNDY3MDFhYWJjMmY5ZWMyNzI5MmU2YjQ0OWIxYjgzYjE5MGUyZDY0MjQ3MjYxZTViMzpoOlQ6Rg>

>
> --- Motion Ends ---
>
> This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:
>
> Discussion (COMPLETE):

> * Start time: 2026-06-30 17:00 UTC
> * End time: 2026-07-30 17:00 UTC

> Vote for approval (7 days):

> * Start time: 2026-07-30 17:00 UTC
> * End time: 2026-08-06 17:00 UTC

>
>
> Rich Smith
> Sr. Director, Product Technical Excellence
>

> [A picture containing drawing Description automatically generated]

[Adriano Santoni]

Actalis votes Yes on Ballot SC-100.

Il 30/07/2026 19:00, 'Rich Smith' via Server Certificate WG (CA/B Forum) ha scritto:

External sender. Verify for authenticity before opening any links or attachments.

--

[Adam Fiock]

SSL.com votes “Yes” on SC-100.

 

-Adam Fiock

 

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Thursday, July 30, 2026 12:01 PM
To: server...@groups.cabforum.org

[rwh...@godaddy.com]

GoDaddy votes "Yes" to SC-100

Thanks,

Rob White

---

From: 'Rich Smith' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Thursday, July 30, 2026 12:00 PM
To: server...@groups.cabforum.org <server...@groups.cabforum.org>

Subject: [Servercert-wg] Voting Period Begins SC-100: DNSSEC Clarification and Consolidation

Ballot SC-100: DNSSEC Clarification and Consolidation --- Ballot Background --- Discussion prior to, and at CA/Browser Forum Face to Face Meeting #67 in Houston, TX revealed that there was some lack of clarity regarding the DNSSEC validation

ZjQcmQRYFpfptBannerStart

This Message Is From an External Sender

This message came from outside your organization.

 

ZjQcmQRYFpfptBannerEnd

[Dimitris Zacharopoulos (HARICA)]

The voting period ended at 17:00 UTC and this vote was registered at 17:15 UTC therefore it will not be counted.

Thank you,

Dimitris Zacharopoulos
CA/B Forum SCWG Chair

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/DM6PR13MB45254F1716549D38C3A6B883B6D22%40DM6PR13MB4525.namprd13.prod.outlook.com.

[Dimitris Zacharopoulos (HARICA)]

The voting period ended at 17:00 UTC and this vote was registered at 17:32 UTC therefore it will not be counted.

Thank you,

Dimitris Zacharopoulos
CA/B Forum SCWG Chair 

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/CO6PR02MB77939FC931F314AC5B70DEF4E0D22%40CO6PR02MB7793.namprd02.prod.outlook.com.