Ballot SMC020: Remove Requirement to Record BR Version of Validation Method

Ballot overview

• Ballot SMC020 removes the requirement in S/MIME Baseline Requirements Section 3.2.2 to record the relevant version number of the S/MIME BR with the validation method.
• It keeps the S/MIME BR aligned with Ballot SC-099, with stated differences for terminology and for allowing the recorded method to reference either the S/MIME BR or the TLS BR.
• The ballot modifies the Baseline Requirements for the Issuance and Management of Publicly-Trusted S/MIME Certificates, based on Version 1.0.16.

What changes

• Section 3.2.2 no longer requires CAs to maintain a record of which validation method, including the relevant version number from the TLS Baseline Requirements or S/MIME Baseline Requirements, was used to validate every domain or email address in issued Certificates.
• Section 5.4.1 is updated so that, effective March 15, 2027, audit logs of verification activities must include:
  • the information being validated, such as the Mailbox Address, domain name, or Organization name
  • the domain name whose control was validated, if applicable and different from the domain portion of the Mailbox Address, such as the Authorization Domain Name or SMTP FQDN
  • the validation method used, such as the section number of the S/MIME BR or TLS BR, or the registered label of an ACME challenge type

Procedure and timing

• Discussion period: October 5, 2026 at 19:00 UTC through October 12, 2026 at 19:00 UTC
• Voting for approval: start time TBD; end time TBD
• The ballot text states that the effective March 15, 2027 logging requirement applies to audit logs of verification activities under Section 5.4.1

Related material

• The linked redline shows a new S/MIME BR version entry for SMC020 and updates the audit log requirement in Section 5.4.1.
• The ballot text explicitly says it maintains consistency with the TLS BR following Ballot SC-099.