Definition of Country and the inclusion of country codes for "a country"

[Martijn Katerbarg]

All,

I’m sure most of your have been watching several bugs these last few weeks regarding which country code to include for any specific geographic location. 

I feel like with the language as currently written, there are multiple definitions, and we have seen CAs taken different approaches to this. To that effect, I would like to start a discussion around this topic.

ISO3166-1 is heavily used, but we’ve seen several cases (country codes) where pure reliance on ISO3166-1, could cause a conflict. ISO3166-1 includes official country codes, but also reserved, historic, and even user-assigned country codes.

Further more, there is the concept of a country within a country. , such as Aruba being a part of The Netherlands. 

I would like to start proposing alternative language for the applicable sections. I expect the F2F agenda is set for the moment. I will attempt to provide a draft proposal by the next regular Teleconference. If anyone has any direct thoughts on this topic, please do reach out, or reply on this list, so we can get this embedded.

Regards,

Martijn

[Adriano Santoni]

This is certainly a discussion worth doing, as the current definition of "Country" turns out to be entirely pointless in view of the stance expressed by root programs on such bugs.

And if it is, it should just be removed from the BRs. And if instead it has a reason to be there, we should try and decide which is that reason :)

(and revise the BRs accordingly)

Adriano

Il 18/09/2026 17:22, 'Martijn Katerbarg' via Server Certificate WG (CA/B Forum) ha scritto:

External sender. Verify for authenticity before opening any links or attachments.

--
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org .
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/PH9PR17MB945067EF2C2DAAA897536129DEE3872%40PH9PR17MB945067.namprd17.prod.outlook.com .

[Fumiaki ONO (大野 文彰)]

I agree that it may be useful to first clarify what purpose the definition of "Country" is intended to serve.

When I read the EV Guidelines, many of the validation concepts appear to be tied to administrative and registration frameworks, such as:

- Jurisdiction of Incorporation / Registration
- Incorporating Agency
- Registration Agency
- Registration Number

In practice, the Country field is often associated with the jurisdiction whose records a CA relies upon to verify legal existence, registration, identity, or location.

With that in mind, I wonder whether it might be useful to think about Country in terms of the existence of authoritative registration and identification systems, rather than primarily in terms of sovereignty or political recognition.

For example, one possible direction could be something along the lines of:

Country:
A geographic jurisdiction represented by an ISO 3166-1 Alpha-2 code that maintains an Incorporating Agency, Registration Agency, or equivalent governmental authority responsible for establishing, registering, recognizing, or identifying natural persons or legal entities.

I am not suggesting that this is necessarily the right wording, but I think it may align more closely with how Country is actually used throughout the EVGs, particularly in the context of identity validation and registration-based verification.

Interested in hearing others' thoughts.

Best regards,
ONO Fumiaki / 大野 文彰
(Japanese name order; family name in uppercase)
SECOM Trust Systems CO., LTD.

2026年9月19日土曜日 0:22:12 UTC+9 martijn....@sectigo.com: