Ballot 70 – EV Code Signing Identifier

Ballot overview

• Ballot 70, titled EV Code Signing Identifier, was a Code Signing Certificate Working Group ballot.
• The page states the ballot passed unanimously.
• The motion says the change is effective immediately.

What the ballot changed

• The ballot deletes and replaces text in the EV Guidelines Appendix H for EV Code Signing Certificates.
• The revised requirements say EV Code Signing Certificates must:
  • Omit the Domain Name required by Section 8.1.1(2).
  • Include a SubjectAltName:permanentIdentifier containing specified jurisdiction and organization data.
  • Format the permanentIdentifier using Unicode in the specified CC-STATE-REG or DATE-ORG structure.
  • Use uppercase Unicode for organization name characters.
  • Use Unicode 002D for hyphens and Unicode 0020 for spaces in the specified fields.
  • Truncate or abbreviate the organization name if needed to keep the field within 64 characters, provided the CA checks the field under section 10.11.1 and does not mislead relying parties.
  • Not issue the certificate if the required formatting cannot be achieved.
  • Set keyUsage to be present, critical, and include digitalSignature only.
  • Set extendedKeyUsage to be present and include id-kp-codeSigning only.

Timing stated in the motion

• The ballot review period comes into effect at 21:00 UTC on April 24, 2012 and closes at 21:00 UTC on May 1, 2012.
• Unless the motion is withdrawn during the review period, the voting period starts immediately afterward and closes at 21:00 UTC on May 8, 2012.