Ballot SC063v4: Make OCSP Optional, Require CRLs, and Incentivize Automation

Result and adoption

• Voting results show the ballot was adopted: Bylaw 2.3(6) requirements were MET for Certificate Issuers, and Bylaw 2.3(6) requirements were MET for Certificate Consumers.
• Quorum requirement under Bylaw 2.3(7) was MET.

Purpose of Ballot SC-063v4

• Updates the Baseline Requirements to make OCSP services optional for CAs.
• Does not prohibit CAs from continuing to support OCSP; if a CA continues supporting OCSP, the same requirements apply as they exist today.

CRL-related changes

• CRLs must conform to the proposed profile.
• CAs must generate and publish either:
  • a full and complete CRL, or
  • a set of partitioned (sharded) CRLs that, when aggregated, represent the equivalent of a full and complete CRL.
• CRL issuance and update timing requirements are specified, including:
  • Subscriber Certificates: update and publish a new CRL at least every seven (7) days if all Certificates include an AIA OCSP pointer, otherwise at least every four (4) days; and update and publish within twenty-four (24) hours after recording a Certificate as revoked.
  • CA Certificates: update and publish a new CRL at least every twelve (12) months; and update and publish within twenty-four (24) hours after recording a Certificate as revoked.
  • CAs must continue issuing CRLs until specified conditions are met (expiration/revocation of Subordinate CA Certificates with the same Subject Public Key, or destruction of the corresponding Subordinate CA Private Key).
• CRL Distribution Points presence requirements are updated, including that CRL Distribution Points are optional for Short-lived Subscriber Certificates and must not be present in OCSP Responder Certificates.

Short-lived certificate changes

• Short-lived certificates are optional; CAs are not required to issue short-lived certificates.
• For short-lived certificates issued on or after 15 March 2026, the proposal stipulates a maximum Validity Period of seven (7) days.
• For short-lived certificates issued on or after 15 March 2024 and prior to 15 March 2026, the maximum Validity Period is less than or equal to 10 days.
• Short-lived certificates are not required to contain a CRLDP or OCSP pointer and are not required to be revoked; certificate invalidation would be through certificate expiry, with optional revocation.

OCSP-related changes

• OCSP responder requirements are updated to apply in the context of Certificates that include an Authority Information Access extension with an id-ad-ocsp accessMethod.
• OCSP responders operated by the CA must support the HTTP GET method.
• The CA may process the OCSP Nonce extension in accordance with RFC 8954.

Effective CRL profile date stated in the redline

• Prior to 2024-03-15, the CA issues CRLs according to the profile specified in the Requirements or the profile specified in Version 1.8.7.
• Effective 2024-03-15, the CA issues CRLs according to the CRL profile specified in these Requirements.