Ballot 107 – Removing Version Numbers to WebTrust and ETSI Standards From CABF Guidelines

Ballot overview

• Ballot 107 was titled Removing Version Numbers to WebTrust and ETSI Standards From CABF Guidelines.
• The ballot page labels it as Withdrawn.
• The motion was made by Mads Henriksveen and endorsed by Inigo Barreira from Izenpe and Kirk Hall from Trend Micro.

Proposed guideline changes

• The motion would have updated the Baseline Requirements and EV Guidelines to refer to then-current audit schemes and standards rather than fixed version numbers.
• In the Baseline Requirements, Section 17.1 Eligible Audit Schemes would have allowed audits under:
  • WebTrust Program for Certification Authorities v2.0
  • A national scheme conforming to ETSI TS 102 042 audit including DVCP, OVCP, EVCP or EVCP+
  • A scheme conforming to ISO 21188:2006
  • For certain Government CAs, a different internal audit scheme if required by the Certificate Policy and if the audit met the stated conditions
• In the EV Guidelines, the motion would have:
  • Required implementation of the then-current WebTrust Program for CAs and then-current WebTrust EV Program, or the then-current ETSI TS 102 042 EV Certificate Policies V2.1.1
  • Required public disclosure of EV Policies and CA business practices in a 24×7 accessible online form
  • Updated Section 17.1 Eligible Audit Schemes to allow either WebTrust Program for Certification Authorities audit plus WebTrust EV Program audit, or ETSI TS 102 042 v2.1.1 audit including EVCP or EVCP+
  • Updated Section 17.4 Pre-Issuance Readiness Audit so that CAs with a currently valid ETSI 102 042 audit would need a point-in-time readiness assessment against ETSI TS 102 042 V2.1.1 EVCP or EVCP+ before issuing EV Certificates, and CAs without a currently valid WebTrust Seal of Assurance for CAs or ETSI 102 042 audit would need one of the listed readiness assessment audits before issuing EV Certificates

Dates stated in the motion

• The review period was to commence on 2013-07-24 and close on 2013-07-31.
• If not withdrawn during review, the voting period would start immediately thereafter and close on 2013-08-07.

Outcome

• The ballot was withdrawn before completion, so it never became normative.