Ballot SMC017: Increase Minimum RSA CA Key Size

Ballot overview

• Ballot SMC017: Increase Minimum RSA CA Key Size was a proposed Final Maintenance Guideline for the S/MIME Baseline Requirements.
• The ballot was withdrawn on May 12, 2026.
• The linked redline updates S/MIME Baseline Requirements Version 1.0.13 to Version 1.0.15.

What the ballot would have changed

• For RSA key pairs, Root and Subordinate CA certificates signed on or after September 15, 2026 would need a modulus size of at least 4096 bits.
• Subscriber certificates would retain the 2048-bit minimum RSA key size.
• Effective September 15, 2027, CAs would not be allowed to issue certificates from any Subordinate CA whose RSA key modulus size is less than 4096 bits.

Notes from the ballot page and redline

• The ballot page says the proposal was intended to increase the minimum RSA key size for Root and Subordinate CA certificates from 2048 to 4096 bits for keys created on or after September 15, 2026.
• The ballot page also says the proposal would sunset issuance from legacy 2048-bit Sub-CAs by September 15, 2027.
• The redline adds entries for SMC017 in the requirements table with dates of September 15, 2026 and September 15, 2027.
• The page includes discussion and voting windows, but the ballot was later withdrawn.