Ballot SC-092: Sunset use of Precertificate Signing CAs

Ballot overview

• Ballot SC-092 proposes updates to the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (TLS BRs) to sunset use of Precertificate Signing CAs, currently specified in Section 7.1.2.4.
• The ballot states that RFC 6962 describes Precertificate Signing Certificates and that RFC 9162 deprecates Precertificate Signing Certificates and the Precertificate Poison extension.

Rationale provided

• Precertificate Signing CAs are described as introducing complexity and risk with little practical benefit.
• The ballot lists reasons including increased chain-validation logic complexity, additional CA infrastructure requirements, difficulty for CT monitors to observe issuance, and a cited real-world critical failure resulting in rejection of a CT log.
• The ballot also states adoption is low (only 2 publicly-trusted CA Owners currently using Precertificate Signing CAs).

Proposed changes / requirements

• Effective March 15, 2026:
  • The Certificate Profile specified in Section 7.1.2.4 MUST NOT be used to issue new certificates.
  • Existing Precertificate Signing CAs MUST NOT be used to issue new Precertificates.
• The ballot content also includes a Baseline Requirements compliance date entry for 2026-03-15 stating CAs MUST NOT use Precertificate Signing CAs to issue Precertificates and MUST NOT issue certificates using the Technically Constrained Precertificate Signing CA Certificate Profile specified in Section 7.1.2.4.

Voting and adoption

• Voting results on the ballot page show 29 votes in total with 29 voting YES and 0 voting NO.
• The ballot page states the Bylaws Requirements were MET, including:
  • Two-thirds (2/3) or more of votes cast by Voting Members in the Certificate Issuer category were in favour.
  • At least fifty percent (50%) plus one (1) of votes cast by Voting Members in the Certificate Consumer category were in favour.
  • At least one Voting Member in each category voted in favour.
  • Quorum was 16 and this requirement was MET.
• The ballot page indicates the ballot current_status is passed.