Ballot 153 – Short-Lived Certificates

Ballot overview

• Ballot 153, Short-Lived Certificates, proposed changes to the Baseline Requirements for short-lived certificates.
• The ballot page states that the revision closed on November 10th 2015.
• The chair received 26 votes from CAs and 5 votes from browsers.
• The page explicitly states that the ballot fails.

Proposed changes

• Add definitions for Issuance Time, Short-Lived Certificate, and Validity Period.
• Revise Section 4.9.10 on online revocation checking requirements.
• For subscriber certificates other than a Short-Lived Certificate containing a cRLDistributionPoints extension, the CA would need to update OCSP information at least every four days, and OCSP responses would need a maximum expiration time of ten days.
• Revise Section 7.1.2.3 so that:
  • cRLDistributionPoints must be present for Short-Lived Certificates that lack an authorityInformationAccess extension.
  • authorityInformationAccess is generally required, with exceptions for stapling and Short-Lived Certificates.
  • The OCSP responder URL may be omitted for Short-Lived Certificates containing a cRLDistributionPoints extension or if the subscriber staples OCSP responses in TLS handshakes.

Ballot process dates

• The review period was to commence on 27 October 2015 and close on 3 November 2015.
• The voting period was to start immediately after the review period and close on 10 November 2015.

Outcome

• The ballot failed, so it never became normative.