Ballot 198 – .Onion Revisions

Ballot overview

• Ballot 198, titled .Onion Revisions, is a Final Maintenance Guideline ballot in the Server Certificate Working Group.
• The ballot clarifies Appendix F of the EV Guidelines regarding issuance of EV Certificates containing .onion domain names.
• It states that inclusion of the Tor Service Descriptor Hash extension in the TBSCertificate is required.

Proposed guideline change

• A CA may issue an EV Certificate containing a .onion Domain Name if issuance complies with Appendix F.
• The CA MUST include the CAB Forum Tor Service Descriptor Hash extension in the TBSCertificate.
• The extension is defined as cabf-TorServiceDescriptorHash with OID 2.23.140.1.31.
• The ballot includes a sequence format for TorServiceDescriptorHash with algorithm and subjectPublicKeyHash fields.

Voting result

• The voting period for Ballot 198 has ended.
• Voting by CAs: 9 yes, 0 no, 4 abstain.
• Voting by browsers: 4 yes, 0 no, 0 abstain.
• Quorum was met with 17 votes cast, and the approval thresholds for both CAs and browsers were met.
• The ballot passes.

Effective timing

• The ballot procedure states that if the vote approves the ballot, there is a 30-day review period after the Chair sends the Review Notice.
• If no Exclusion Notices are filed, the ballot becomes effective at the end of the Review Period.
• If Exclusion Notice(s) are filed, ballot approval is rescinded and a PAG is to be created.