Ballot SC075: Pre-sign linting

Ballot overview

• Ballot SC075, Pre-sign linting, proposed a Final Maintenance Guideline for the TLS Baseline Requirements.
• The motion modified the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates based on Version 2.0.5.
• The ballot was proposed by Dimitris Zacharopoulos of HARICA and endorsed by Corey Bonnell of DigiCert and Ben Wilson of Mozilla.

Voting results

• 25 Certificate Issuer votes were cast, all YES, with no abstentions.
• 3 Certificate Consumer votes were cast, all YES, with no abstentions.
• The ballot met the Bylaw 2.3(6) issuer and consumer voting thresholds.
• The quorum was 13, and that requirement was met.

Review period and IPR process

• The review notice states a 30-day review period for one Final Maintenance Guideline.
• Start of Review Period: 2024-06-28 09:00 UTC.
• End of Review Period: 2024-07-28 09:00 UTC.
• The notice says members with Essential Claims to exclude must submit a written Notice to Exclude Essential Claims before the end of the Review Period.

Ballot content

• The ballot adds linting requirements to help CAs avoid certificate misissuance by using open-source linters before issuing a precertificate.
• The redline adds sections for linting of to-be-signed Certificate content and linting of issued Certificates.
• The ballot text says the requirements are not mandatory for Certification Authorities unless and until they become adopted and enforced by relying-party Application Software Suppliers.
• The redline also includes a relevant dates table showing a compliance date for linting of to-be-issued Certificates.

Compliance timing

• The redline’s relevant dates table states that on 2024-09-15, the CA SHOULD implement a linting process to test the technical conformity of the to-be-issued Certificate with these Requirements.
• The same table states that on 2025-03-15, the CA SHALL implement a linting process to test the technical conformity of the to-be-issued Certificate with these Requirements.
• The same table also states that on 2025-03-15, the CA SHOULD use a linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits.