Final Minutes: Forum Plenary, 2 July 2026

41 views
Skip to first unread message

Dean Coclin

unread,
Jul 30, 2026, 11:33:24 AM (5 days ago) Jul 30
to 'Nagelkerke, Marijn' via Public (CA/B Forum)

 

Meeting Title: CA/Browser Forum Teleconference
Date: 2026-07-02
Chair: Tim Callan
Note Taker: Aaron Gable

 

1. Administrivia

  • Note Well was read by Dimitris Zacharopoulos during the preceding meeting.
  • Roll Call will be taken automatically by Webex.
  • Minutes from the 18 June 2026 meeting (taken by Scott Rea) are approved.

2. Working Group / Subcommittee Updates

 

Server Certificate Working Group

  • Dimitris Zacharopoulos reports on a new draft ballot that changes the EKU requirements for cross-certificates, inspired by existing CCADB policy and a Let's Encrypt incident.

Validation Subcommittee

  • Stephen Davidson reports that there are no major updates on outstanding ballots.
  • He also reports that the subcommittee may consider further improvements to the EV Guidelines in the future.

Code Signing Working Group

  • No update.

S/MIME Working Group

  • Stephen Davidson reports that SMC-02 (increasing minimum RSA key sizes) has passed and entered the IPR review period.
  • Discussion has begun on an S/MIME ballot to match the draft SCWG ballot discussed above, aligning cross-sign EKU requirements.
  • Deutsche Telekom Security has joined the Working Group as a CA member.

Network Security Working Group

  • Dustin Hollenback reports that Microsoft is proposing a cleanup ballot to reorganize the NSRs, including renumbering several sections.
  • Additionally, Tim Hollebeek intends to propose a ballot regarding logging but will wait until the preceding ballot is done.

Definitions and Glossary Working Group

  • Polina Glazyrina reports that there has been no on-list feedback regarding the initial document shared two weeks ago.
  • Tim Callan encourages folks to get involved, and notes that lack of feedback will result in the DGWG moving forward with the document as-is.

Infrastructure Subcommittee

  • Jos Purvis reports that mailing lists are now being archived to mail-archive.com.
  • There's a request to adjust how the member tools system tracks IPR signing.
  • Beginning an initiative to produce documentation on how to interact with the Forum's Git repositories on GitHub:
    • Aaron Poulson is working on a Git 101 presentation
    • If you have questions about how to use Git, please direct them to the Infrastructure subcommittee so they can incorporate them into the materials.

IPR Subcommittee

  • Ben Wilson reports that about 81 parties have signed the new IPR Agreement.

3. Any Other Business

 

Discussion of Incorporation as a Non-Profit

  • Ben Wilson kicks off the discussion by noting that it would be beneficial for the Forum to be recognized as a 501(c)(3) for the purpose of receiving donations like Cisco Webex.
  • Ben has petitioned the Mozilla Foundation to sponsor the request for the Webex donation as a public benefit organization, but has not heard back.
  • Trevoli Ponds-White remarks that non-profit status would similarly be useful for receiving donations of AWS services.
  • Chad Dandar supports further investigation of gaining non-profit status, and asks whether HARICA can continue to fund Webex in the interim?
  • Dimitris Zacharopoulos confirms that yes, HARICA can continue to do so if a donation is not secured.
  • Tim Callan inquires as to whether this needs to be considered a formal initiative of the Forum?
  • Ben Wilson points out that the first hurdle is identifying a person to be the "registered agent" who is the primary point of contact with the government.
  • They have investigated registration both in Switzerland and in the US, including ways to register as an "unincorporated association".
  • Tim Callan points out that registration in the US is state specific, and that you need a person in the specific state to act as the registered agent.
  • Scott Rea suggests incorporating in Utah, where the Forum has many members who could act as registered agents.
  • Jos Purvis reminds the group that we have to ensure that the organization type is compatible with receiving donations; many orgs will not donate to non-501(c)(3)s.
  • Tim Callan inquires as to the tax implications of receiving a donation, and Ben Wilson responds that they usually won't donate unless you are a tax-exempt entity like a 501(c)(3).
  • Tim Callan proposes having this as a core topic at the September Face-to-Face meeting.
  • Dimitris asks who is going to take the lead on driving the project.
  • Rich Smith proposes that, whoever drives it, we use an external organization to provide the constant registered agent regardless of who the current CA/BF Chair is or where they live.
  • Dustin Hollenback says that it's important for a proposal in September to consider non-US options for incorporation.

4. Adjournment

  • Vienna Face-to-Face will be September 22-24; sign-ups are still open.
  • The Spring 2027 Face-to-Face will be Feb 23-25 in Scottsdale.
  • The next meeting will be 16 July, 2026.
  • The meeting is adjourned.

Attendees

 

Aaron Poulsen (SSL.com), Adam Fiock (SSL.com), Adriano Santoni (Actalis S.p.A.), Arman Asemani (Apple), Ben Wilson (Mozilla), Chad Dandar (Cisco Systems), Corey Rasmussen (OATI), Cynethia Brown (US Federal PKI Management Authority), Daryn Wright (Apple), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Dustin Hollenback (Apple), Enrico Entschew (D-TRUST), Hazhar Ismail (MSC Trustgate Sdn Bhd), Hogeun Yoo (NAVER Cloud Trust Services), Inaba Atsushi (GlobalSign), Iñigo Barreira (Sectigo), Jeanette Snook (Visa), Johnny Reading (GoDaddy), Jos Purvis (Fastly), Jun Okura (Cybertrust Japan), Karina Sirota (Microsoft), Lucy Buecking (IdenTrust), Luis Osses (Amazon), Mahua Chaudhuri (Microsoft), Michael Slaughter (Amazon), Michelle Coon (OATI), Nate Smith (GoDaddy), Nome Huang (TrustAsia), Ono Fumiaki (SECOM Trust Systems), Paul van Brouwershaven (Digitorus), Peter Miskovic (Disig), Polina Glazyrina (Sectigo), Rebecca Kelly (SSL.com), Rich Smith (DigiCert), Rob White (GoDaddy), Rollin Yu (TrustAsia), Roman Fischer (SwissSign), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Sean Huang (TWCA), Stephen Davidson (DigiCert), Steven Deitte (GoDaddy), Tim Callan (Sectigo), Tobias Josefowitz (Opera Software AS), Trevoli Ponds-White (Amazon), Tsung-Min Kuo (Chunghwa Telecom), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Zoey Wang (TrustAsia)

 

Reply all
Reply to author
Forward
0 new messages