Ballot CSC-32: Make a Reserved Policy OID mandatory

Ballot overview

• Ballot: CSC-32: Make a Reserved Policy OID mandatory
• Working group: Code Signing Certificate Working Group
• Purpose: Update the Code Signing Baseline Requirements (from version 3.10) to modify requirements for Certificate policy object identifiers (OIDs) in Subscriber Certificates.
• Goals stated on the ballot page:
  • Require inclusion of a Reserved Policy OID in the CertificatePolicies extension.
  • Make it optional to include other CA-defined Reserved Policy OID(s) in the CertificatePolicies extension.

Voting and adoption status

• The ballot page states the voting period has completed and the ballot PASSED.
• The ballot page states No IPR Exclusion Notices were filed.
• The ballot is stated as adopted as of November 17, 2025.

Compliance / requirement date stated in the provided evidence

• The provided GitHub compare text states:
  • Effective September 15, 2026 a Certificate issued to a Subscriber MUST contain exactly one of the reserved policy OIDs specified in Section 7.1.6.1 in the CertificatePolicies extension.
  • CAs complying with these Requirements MAY also assert one or more CA-defined policy identifier(s) in the CertificatePolicies extension indicating adherence to and compliance with these Requirements.

Procedure dates shown on the ballot page (discussion and voting)

• Discussion start and end times are listed.
• Voting start and end times are listed.