Ballot 159 – Amend Section 4 of Baseline Requirements

Ballot overview

• Ballot 159, Amend Section 4 of Baseline Requirements, is shown on the CA/Browser Forum site.
• The page states Failed quorum.

What the ballot was intended to do

• Maintain consistency between the S/MIME Baseline Requirements and the TLS Baseline Requirements with changes introduced by Ballots SC096 and SC097.
• Create a carve-out so DNSSEC logging requirements are not in scope.
• Clarify that, for audit purposes, change management logging can confirm whether the appropriate controls are in effect.
• Sunset remaining use of SHA-1 signatures in Certificates and CRLs.
• Require revocation of all unexpired Subordinate CA Certificates issuing S/MIME that contain the SHA-1 signature algorithm.
• Preserve use of SHA-1 for issuerKeyHash and issuerNameHash values as required by RFC 5019.
• Include minor formatting corrections.

Outcome

• The ballot failed quorum, so it did not become normative.