Ballot SC079v2: Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate

Ballot overview

• Ballot SC079v2 is titled Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate.
• It is a Final Maintenance Guideline for the TLS Baseline Requirements.
• The motion was proposed by Paul van Brouwershaven of Entrust and endorsed by Ben Wilson of Mozilla and Thomas Zermeno of SSL.com.

What the ballot changes

• The ballot duplicates the Certificate Policies content into section 7.1.2.2.6 for Cross-Certified Subordinate CA Certificate Profiles.
• It changes the requirement from exactly one Reserved Certificate Policy Identifier to at least one Reserved Certificate Policy Identifier.
• It allows multiple Reserved Certificate Policy Identifiers in a Cross-Certified Subordinate CA Certificate, except when any Subscriber Certificates chain directly to the certificate issued under this profile.
• It clarifies the description of policyIdentifier contents in both affected sections.
• The GitHub diff shows the certificatePolicies reference in the BR.md table moved to the new section 7.1.2.2.6.

Voting and adoption

• Certificate Issuers: 19 votes total, 19 YES, 0 NO, 0 ABSTAIN.
• Certificate Consumers: 2 votes total, 2 YES, 0 NO, 0 ABSTAIN.
• Bylaw 2.3(6) requirements were met for both Issuer and Consumer categories.
• Bylaw 2.3(7) quorum was 14 and was met.
• The ballot page states that no abstentions were filed and that the ballot was adopted.

Review period

• The review period started on 14 October 2024 at 16:00 UTC.
• The review period ended on 14 November 2024 at 16:00 UTC.
• The IPR notice says members with Essential Claims to exclude had to submit a written Notice to Exclude Essential Claims before the end of the Review Period.

Compliance impact

• Cross-Certified Subordinate CA Certificates may include at least one Reserved Certificate Policy Identifier.
• If any Subscriber Certificates will chain up directly to the certificate issued under this profile, the Cross-Certified Subordinate CA Certificate must contain exactly one Reserved Certificate Policy Identifier.
• If the Issuing CA wishes to express no policy restrictions and the Subordinate CA is an Affiliate of the Issuing CA, the Issuing CA may use anyPolicy as the only PolicyInformation value.
• policyQualifiers are not recommended, and if present must be limited to the permitted id-qt-cps qualifier.

Linked artifacts

• The redline PDF and GitHub compare both show the same normative change to section 7.1.2.2.6.
• The IPR policy artifact is effective July 3, 2018 and describes the review and exclusion process used for the ballot.