Ballot SC022v2: Reduce Certificate Lifetimes

Ballot overview

• Ballot SC022v2, Reduce Certificate Lifetimes, proposed changes to the Baseline Requirements and the EV SSL Certificate Guidelines.
• The ballot page states the voting period for Ballot SC22 had ended and the ballot had failed.
• The motion text says the ballot would align certificate validity and data reuse periods, and clarify how validity periods are measured.

Voting results and validity

• Certificate Issuers: 33 votes total including abstentions; 11 yes, 20 no, 2 abstain.
• Certificate Consumers: 7 votes total including abstentions; 7 yes, 0 no, 0 abstain.
• The page states the approval requirements were met for both Certificate Issuers and Certificate Consumers, and quorum was met.
• Despite that, the ballot page explicitly says the ballot had failed.

Main normative changes described in the artifacts

• Baseline Requirements and EV Guidelines were updated to reduce the maximum certificate validity period to 398 days.
• The reuse of validation information was limited to 398 days.
• The validity period definition was updated to use the RFC 5280 notBefore through notAfter measurement for certificates issued on or after the new effective date.
• The EV Guidelines were aligned with the Baseline Requirements for validity and reuse periods.
• The motion text says the time and timezone for effective dates are interpreted as midnight, Coordinated Universal Time.

Dates shown in the evidence

• The linked document diffs change the effective date from 1-Mar-2020 to 1-Apr-2020.
• The Baseline Requirements diff shows subscriber certificates issued on or after 1 April 2020 SHOULD NOT have a validity period greater than 397 days and MUST NOT have a validity period greater than 398 days.
• The EV Guidelines diff shows certificates issued on or after 2020-04-01 MUST NOT have a validity period greater than 398 days.
• The EV Guidelines also say EV Subscriber Certificates issued prior to 1 April 2020 have a maximum validity period of twelve months.
• The Baseline Requirements diff says subscriber certificates issued on or after 1 March 2018 but prior to 1 April 2020 MUST NOT have a validity period greater than 825 days.
• The motion text says browsers would be able to technically enforce the reduced validities as early as April 2020, and would fully benefit from the reduction until 825 days after the last day such certificates can be issued, or June 2022.

Outcome

• The ballot page explicitly says the ballot failed, so the proposal did not become normative.