CSC-17 passed

Ballot CSC-17: Subscriber Private Key Extension

Code Signing Certificate Working Group

Key dates

Effective date: 28 Oct 2022 3 years ago
Voting opened: 28 Oct 2022 3 years ago
IPR review ends: 28 Oct 2022 3 years ago
Discussion opened: 27 Sep 2022 3 years ago
Discussion closed: 27 Oct 2022 3 years ago

Resources

± Redline https://cabforum.org/uploads/Baseline-Requirements-for-the-Issuance-and-Management-of-Code-Signing.v3.2_redline.pdf here

✉ Mailing list https://lists.cabforum.org/pipermail/cscwg-public/2022-October/000898.html here

AI Summary

Generated 2026-06-23 21:26 UTC

Ballot overview

Ballot CSC-17, Subscriber Private Key Extension, updates the Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates.
The ballot changes the effective date for the subscriber key protection and verification requirements in:
- Section 6.2.7.4.1 Subscriber Private Key protection
- Section 6.2.7.4.2 Subscriber Private Key verification
- Section 1.2.2 Relevant Dates
The stated purpose is to extend the effective date to provide approximately 1 year from the public announcement of the requirement change for affected parties to implement the changes.

Voting and review outcome

The ballot has PASSED.
The IPR review period ended on October 28, 2022 and no exclusion notices were filed.

Effective date and applicability

The final documents state an effective date of 2022-10-28.
The ballot text also says the change replaces the effective date of November 15, 2021 with June 1, 2023 for the subscriber key protection and verification requirements.
The evidence does not provide additional conditional applicability beyond the referenced sections.

Model: gpt-5.4-mini Confidence: 0.92 Result: passed

Effective date: 2022-10-28
Voting opened: 2022-10-28
IPR review ends: 2022-10-28
Discussion opened: 2022-09-27
Discussion closed: 2022-10-27

Applicability and conditions

2023-06-01 — CAs must implement the updated subscriber private key protection and verification requirements by this date Subscriber key protection and verification requirements in Section 6.2.7.4.1, Section 6.2.7.4.2, and Section 1.2.2 Relevant Dates

AI-generated from the CABF ballot page. The official CABF article remains the authoritative source.

Proposers

Ian McMillan of Microsoft and endorsed by Tim Hollebeek of DigiCert and Bruce Morton of Entrust.

Excerpt

SearchHome » All CA/Browser Forum Posts » Ballot CSC-17: Subscriber Private Key ExtensionBallot CSC-17: Subscriber Private Key ExtensionNotice of Review Period (Mailing list post is available here.)

View on cabforum.org → Last fetched 15 hours ago