Ballot SC031: Browser Alignment

Ballot overview

• Ballot SC031: Browser Alignment was a motion in the Server Certificate Working Group.
• The ballot page says the voting period for Ballot SC31v3 has ended and the ballot has Passed.
• Voting by Certificate Issuers met the required threshold, and Voting by Certificate Consumers also met the required threshold.
• The page states quorum was met.

What the ballot changed

• The ballot modified the Baseline Requirements and the EV Guidelines.
• It was described as a regular part of Root Program maintenance to incorporate Root Program-specific requirements that are either effective or will, in the future, be effective.
• The ballot text says the Chair or Vice-Chair is permitted to update the Relevant Dates of the Baseline Requirements and the EV Guidelines to reflect these changes.
• The linked redlines show changes including:
  • OCSP response validity and update timing requirements effective 2020-09-30.
  • A new 2020-09-30 requirement that Subject and Issuer Names for all possible certification paths be byte-for-byte identical.
  • A 2020-09-30 requirement that Subscriber Certificates include a CA/Browser Form Reserved Policy Identifier in the Certificate Policies extension.
  • A 2020-09-30 requirement that all OCSP and CRL responses for Subordinate CA Certificates include a meaningful reason code.
  • A 2020-08-01 audit report structure requirement.
  • A 2020-09-01 validity-period rule for Subscriber Certificates.
  • Revisions to key size, EKU, authority key identifier, and algorithm identifier requirements.

Effective dates and phased requirements

• The ballot text includes multiple effective dates in the redlines and in the motion context.
• Some requirements apply only to certain certificate types or only after a stated date.
• The ballot page also notes that the full description and motivation of each change, along with the effective dates, are available in the linked pull request.