Ballot SMC018: Realignment of Multipurpose use cases
S/MIME Certificate Working Group
Key dates
- Effective date
- 01 Jul 2027 10 months from now
- Discussion opened
- 11 Aug 2026 5 days ago
- Discussion closed
- 18 Aug 2026 1 day from now
Resources
AI Summary
Ballot overview
- Ballot SMC018, Realignment of Multipurpose use cases, modifies the S/MIME Baseline Requirements based on Version 1.0.15.
- It is proposed as a Final Maintenance Guideline.
- The ballot page summary says it implements CCADB Policy Section 6.3 relating to cross-certificates into the S/MIME BR effective immediately.
- It also says that effective July 1, 2027, id-kp-emailProtection is mandatory and id-kp-clientAuth is optional, and these are the only EKUs permitted in both Subordinate CA Certificates and Subscriber Certificates.
- The ballot further clarifies that Legacy Generation profiles were deprecated effective July 15, 2025.
Key requirement changes
- For Subordinate CA Certificates used to issue S/MIME Certificates, id-kp-emailProtection must be present and id-kp-clientAuth may be present.
- For Subordinate CA Certificates signed before July 1, 2027, other EKU values may still be present.
- For Certificates issued before July 1, 2027, other EKU values may still be present in Multipurpose and Legacy generation certificates.
- For non-dedicated issuer hierarchies where the Subject is dedicated to S/MIME, only id-kp-emailProtection, or id-kp-emailProtection and id-kp-clientAuth, may be present in extKeyUsage for Cross Certificates.
- The ballot also updates the Definitions section so that Legacy Generation profiles are described as deprecated effective July 15, 2025.
Process information
- Discussion starts August 11, 2026 at 13:00:00 UTC.
- Discussion ends August 18, 2026 at 13:00:00 UTC.
- The linked redline is the GitHub compare from 9ad1d24fb86b8ddbe9068122136117a4930c4b44 to 326bc03807283b3af1b6f702968ec23707ecada5.
- Effective date
- 2027-07-01
- Discussion opened
- 2026-08-11
- Discussion closed
- 2026-08-18
2027-07-01 — id-kp-emailProtection becomes mandatory and id-kp-clientAuth becomes the only optional EKU alongside it; other EKUs are no longer permitted Subordinate CA Certificates used to issue S/MIME Certificates; also the only permitted EKUs in Subordinate CA Certificates and Subscriber Certificates per the ballot summary
2027-07-01 — other EKU values may still be present Subordinate CA Certificates signed before this date
2027-07-01 — other EKU values may still be present Multipurpose and Legacy generation Certificates issued before this date
2025-07-15 — Legacy Generation profiles were deprecated Legacy Generation profiles
AI-generated from the CABF ballot page. The official CABF article remains the authoritative source.
Proposers
Stephen Davidson (DigiCert) and endorsed by Dustin Hollinback (Apple) and Ashish Dhiman (GlobalSign)
Excerpt
SearchHome » All CA/Browser Forum Posts » Ballot SMC018: Realignment of Multipurpose use casesBallot SMC018: Realignment of Multipurpose use casesBallot SMC018: Realignment of Multipurpose use casesSummary: This ballot implements the requirements of CCADB Policy Section 6.3 relating to cross-certificates into the S/MIME BR effective immediately.