Weekly github digest (Server Certificate Working Group)
402 views
Skip to first unread message
Infrastructure Bot
Oct 5, 2025, 3:35:29 AMOct 5
to server...@groups.cabforum.org
Sunday October 05, 2025
Issues
cabforum/servercert (+2/-0/💬3)
2 issues created:
- #621 Clean up usage of "FQDN" versus "FQDN or Wildcard Domain Name" (by aarongable)
- #620 datatracker (by Sanel0101)
3 issues received 3 new comments:
- #621 Clean up usage of "FQDN" versus "FQDN or Wildcard Domain Name" (1 by github-actions)
- #620 datatracker (1 by github-actions)
- #580 Update Section 4.9.1.1 to explicitly reference CAA violations (1 by BenWilson-Mozilla) clean-up
Pull requests
cabforum/servercert (+1/-0/💬0)
1 pull requests submitted:
- #619 SC-XXX: Cleanup for ADN CNAME use (by richardwsmith)
Infrastructure Bot
Oct 12, 2025, 3:35:23 AMOct 12
to server...@groups.cabforum.org
Sunday October 12, 2025
Pull requests
cabforum/servercert (+1/-0/💬0)
1 pull requests submitted:
- #622 Draft Ballot SC-XX: Improve Certificate Problem Reports and Clarify the Meaning of Revocation (by XolphinMartijn)
Infrastructure Bot
Oct 19, 2025, 3:35:15 AMOct 19
to server...@groups.cabforum.org
Sunday October 19, 2025
Issues
cabforum/servercert (+1/-0/💬2)
1 issues created:
- #623 bad reference to BR in EVG postalCode field requirement (by mr-m0nst3r)
2 issues received 2 new comments:
- #623 bad reference to BR in EVG postalCode field requirement (1 by github-actions)
- #609 Clarify which TLDs can be issued wildcard certificates (1 by richardwsmith)
Pull requests
cabforum/servercert (+2/-0/💬0)
2 pull requests submitted:
Infrastructure Bot
Oct 26, 2025, 3:35:04 AMOct 26
to server...@groups.cabforum.org
Sunday October 26, 2025
Pull requests
cabforum/servercert (+1/-0/💬1)
1 pull requests submitted:
1 pull requests received 1 new comments:
- #619 SC-XXX: Cleanup for ADN CNAME use (1 by defacto64)
Infrastructure Bot
Nov 2, 2025, 2:35:09 AMNov 2
to server...@groups.cabforum.org
Sunday November 02, 2025
Pull requests
cabforum/servercert (+2/-0/💬7)
2 pull requests submitted:
2 pull requests received 7 new comments:
- #619 SC-XXX: Cleanup for ADN CNAME use (6 by aarongable, defacto64, jsha, timfromdigicert)
- #573 SC-86: Sunset the Inclusion of Domain Names with an IP Reverse Zone Suffix (1 by caramelpony)
Infrastructure Bot
Nov 9, 2025, 2:35:20 AMNov 9
to server...@groups.cabforum.org
Sunday November 09, 2025
Issues
cabforum/servercert (+0/-0/💬5)
3 issues received 5 new comments:
- #576 Fix TBR 3.2.2.9 Formatting (1 by karolina-ads) baseline-requirements clean-up
- #496 clarify (none) use of space separators on contactphone (1 by karolina-ads) baseline-requirements clean-up
- #303 EVGs: Remove references to code signing and focus language on TLS (3 by BenWilson-Mozilla, karolina-ads) enhancement ev-guidelines clean-up
Pull requests
cabforum/servercert (+2/-0/💬3)
2 pull requests submitted:
2 pull requests received 3 new comments:
- #627 SC-XXX: Clarify Authorization Domain Name (alternative to #619) (2 by jsha)
- #615 SC-092: "Sunset use of Precertificate Signing CAs" (1 by dzacharo)
Infrastructure Bot
Nov 16, 2025, 2:36:10 AMNov 16
to server...@groups.cabforum.org
Sunday November 16, 2025
Pull requests
cabforum/servercert (+3/-0/💬2)
3 pull requests submitted:
2 pull requests received 2 new comments:
- #627 SC-XXX: Clarify Authorization Domain Name (alternative to #619) (1 by cardonator)
- #608 SC-088v3: DNS TXT Record with Persistent Value DCV Method (1 by dzacharo)
Infrastructure Bot
Nov 23, 2025, 2:36:05 AMNov 23
to server...@groups.cabforum.org
Sunday November 23, 2025
Issues
cabforum/servercert (+0/-0/💬5)
5 issues received 5 new comments:
- #580 Update Section 4.9.1.1 to explicitly reference CAA violations (1 by dzacharo) clean-up
- #496 clarify (none) use of space separators on contactphone (1 by dzacharo) baseline-requirements clean-up
- #436 Explore & add transition period for CAs not compliant with profiles from SC-062 (1 by dzacharo) baseline-requirements
- #303 EVGs: Remove references to code signing and focus language on TLS (1 by dzacharo) enhancement ev-guidelines clean-up
- #299 BRs: Consider including EVG-style section anchors in the BR Effective Dates table (1 by dzacharo) enhancement baseline-requirements clean-up
Pull requests
cabforum/servercert (+4/-0/💬3)
4 pull requests submitted:
2 pull requests received 3 new comments:
- #627 SC-XXX: Clarify Authorization Domain Name (alternative to #619) (2 by jsha)
- #619 SC-XXX: Cleanup for ADN CNAME use (1 by jsha)
Infrastructure Bot
Nov 30, 2025, 2:35:27 AM (7 days ago) Nov 30
to server...@groups.cabforum.org
Sunday November 30, 2025
Issues
cabforum/servercert (+0/-9/💬70)
43 issues received 70 new comments:
- #623 bad reference to BR in EVG postalCode field requirement (3 by dzacharo, kate-alekseeva) editorial clean-up
- #617 Remove all instances of precertificate signing CAs from the TLS BRs (1 by dzacharo) baseline-requirements clean-up
- #612 Issuance of SRV-ID (SRVName) certificates (1 by dzacharo)
- #602 Add mass revocation planning requirement to BRs (1 by dzacharo)
- #599 Please add a requirement that CAs must issue certificates with key usages “TLS server” and “TLS client”, at the least, to end users (1 by dzacharo)
- #589 Update Section 7.2 to specify a serial number MUST NOT appear on a CRL more than once (1 by dzacharo) baseline-requirements ballot simple
- #588 Sunset 7.1.2.4 - Technically Constrained Precertificate Signing CA Certificate Profile (1 by dzacharo)
- #582 Incorrect link to TBRs in recommended CPS language (1 by dzacharo)
- #578 NIST P-256, P-384, ... still considered secure? SafeCurves disregarded? (1 by dzacharo)
- #576 Fix TBR 3.2.2.9 Formatting (1 by dzacharo) baseline-requirements clean-up
- #570 Formatting / bullet point issues with WHOIS and MPIC ballots (1 by karolina-ads) baseline-requirements clean-up
- #558 Make it possible to validate conformance of certificate serial number requirements (1 by dzacharo) baseline-requirements backlog complex
- #533 Clarify BR 3.2.2.4.7 (1 by dzacharo) baseline-requirements validation-sc moderate
- #532 Clarify that non-TLS leaf Certificates are not allowed to be issued from a server TLS-capable Issuing CA (4 by CBonnell, XolphinMartijn, dzacharo) baseline-requirements ballot moderate
- #526 Clean up usage of the "Certificate Profile" Defined Term (2 by CBonnell, dzacharo) baseline-requirements
- #525 Update NCSSRs references (1 by dzacharo)
- #520 Clarify Revocation Codes for Intermediate CAs (1 by dzacharo) baseline-requirements ballot simple
- #519 The BR and Delegated OCSP responder signing certificates (1 by dzacharo) baseline-requirements ballot simple
- #512 Remove "point‐in‐time readiness assessment" from BR 8.1 (2 by BenWilson-Mozilla, dzacharo) baseline-requirements clean-up
- #506 Update to description of certificateHold (9 by BenWilson-Mozilla, CBonnell, XolphinMartijn, dzacharo) baseline-requirements moderate
- #505 Making CRLs required and OCSP Optional (1 by dzacharo)
- #499 Review of EVG cabfOrganizationIdentifier (6 by AdrianMueller-sws, CBonnell, barrini, defacto64, dzacharo) ev-guidelines validation-sc simple
- #467 Improve EVG 11.13, 11.8.4, and 14.1.3 to clarify that automatic issuance is permitted (6 by BenWilson-Mozilla, barrini, dzacharo) ev-guidelines validation-sc moderate
- #456 Clarify "or hosting service relationship" in BR section 9.6.3 (1 by dzacharo) baseline-requirements validation-sc ballot complex
- #449 Clarify reusability of Validation of authority (3.2.5 vs. 4.2.1) (1 by dzacharo) baseline-requirements clean-up
- #442 Define (or reference an existing definition for) the expected method by which CAs are "made aware" (2 by XolphinMartijn, dzacharo) baseline-requirements
- #437 Clarify when it's acceptable to "backdate" a CRL entry (1 by dzacharo)
- #431 Align OV and EV organizationName requirements (2 by XolphinMartijn, dzacharo) baseline-requirements simple
- #400 "Certificate request" - Revisit usage (1 by dzacharo) baseline-requirements validation-sc simple
- #384 Prohibit the inclusion of dataEncipherment and keyAgreement KU bits (1 by dzacharo) baseline-requirements validation-sc profiles-future simple
- #375 Clarify protocols permitted for DNS validation (1 by dzacharo) validation-sc
- #374 Clarify HTTP validation requirements (1 by dzacharo) baseline-requirements validation-sc simple
- #362 Delegating DNS to the CA for purposes of validating domains (1 by dzacharo) baseline-requirements validation-sc
- #356 Ensure CAs are collecting sufficient data to investigate CAA errors (1 by dzacharo) baseline-requirements validation-sc moderate
- #355 Create non-exhaustive list of Registration agencies used by CAs for EV JOI (1 by dzacharo) ev-guidelines validation-sc complex
- #352 Require DNSSEC validation for CAA records when the domain is DNSSEC enabled (1 by dzacharo) validation-sc
- #326 Validity period for Technically Constrained Sub-CA and validation period for Domain Namespace (1 by dzacharo) baseline-requirements validation-sc simple
- #299 BRs: Consider including EVG-style section anchors in the BR Effective Dates table (1 by karolina-ads) enhancement baseline-requirements clean-up
- #274 BRs: Clarify whether 3.2.2.8 can be delegated (1 by dzacharo) baseline-requirements simple
- #252 BRs: Clarify what "revocation" means on a technical level (1 by dzacharo) baseline-requirements moderate
- #229 BRs: Clarify what "an appropriate way" means for wildcards and gTLDs (1 by dzacharo) baseline-requirements simple
- #187 Baseline Requirements: Should Technically Constrained Sub CAs require a Key Generation report? (1 by dzacharo) baseline-requirements moderate
- #153 Clarify validation requirements for .arpa (1 by dzacharo) baseline-requirements validation-sc
9 issues closed:
- #612 Issuance of SRV-ID (SRVName) certificates
- #602 Add mass revocation planning requirement to BRs
- #599 Please add a requirement that CAs must issue certificates with key usages “TLS server” and “TLS client”, at the least, to end users
- #588 Sunset 7.1.2.4 - Technically Constrained Precertificate Signing CA Certificate Profile
- #582 Incorrect link to TBRs in recommended CPS language
- #578 NIST P-256, P-384, ... still considered secure? SafeCurves disregarded?
- #505 Making CRLs required and OCSP Optional
- #352 Require DNSSEC validation for CAA records when the domain is DNSSEC enabled validation-sc
- #153 Clarify validation requirements for .arpa baseline-requirements validation-sc
Infrastructure Bot
2:36 AM (9 hours ago) 2:36 AM
to server...@groups.cabforum.org
Sunday December 07, 2025
Issues
cabforum/servercert (+2/-1/💬13)
2 issues created:
- #642 Update EVGs, 3.2.2.14.1 #6 to include RDAP (by clintwilson) ev-guidelines clean-up
- #638 AlphaSTAR (by tiffanydawnatkins-cloud)
7 issues received 13 new comments:
- #642 Update EVGs, 3.2.2.14.1 #6 to include RDAP (1 by github-actions) ev-guidelines clean-up
- #638 AlphaSTAR (1 by github-actions)
- #580 Update Section 4.9.1.1 to explicitly reference CAA violations (3 by BenWilson-Mozilla, dzacharo, ryancdickson) baseline-requirements clean-up
- #526 Clean up usage of the "Certificate Profile" Defined Term (2 by dustinhollenback-apple, dzacharo) baseline-requirements
- #506 Update to description of certificateHold (1 by dzacharo) baseline-requirements moderate
- #499 Review of EVG cabfOrganizationIdentifier (3 by defacto64, dzacharo) ev-guidelines validation-sc simple
- #467 Improve EVG 11.13, 11.8.4, and 14.1.3 to clarify that automatic issuance is permitted (2 by BenWilson-Mozilla, dzacharo) ev-guidelines validation-sc moderate
1 issues closed:
Pull requests
cabforum/servercert (+3/-0/💬0)
3 pull requests submitted:
Reply all
Reply to author
Forward
0 new messages