Ballot SMC05: Adoption of CAA for S/MIME

Ballot overview

• Ballot SMC05, Adoption of CAA for S/MIME, proposed changes to the S/MIME Baseline Requirements to introduce Certification Authority Authorization processing for email addresses as defined in RFC 9495.
• The ballot also included minor typographic and formatting corrections.
• The motion modified S/MIME Baseline Requirements version 1.0.2 into version 1.0.3.

Voting and adoption

• The voting period completed and the ballot passed.
• Certificate Issuers: 19 yes, 0 no, 0 abstain.
• Certificate Consumers: 3 yes, 0 no, 0 abstain.
• The bylaws requirements for issuer and consumer approval and quorum were met.
• The IPR period completed with no IPR Exclusion Notices filed, and the ballot was adopted as of February 20, 2024.

Main requirements added

• Starting on September 15, 2024, CAs must state their policy or practice on processing CAA Records for Mailbox Addresses in Section 4.2 of their CP and/or CPS.
• Starting on September 15, 2024, prior to issuing a Certificate that includes a Mailbox Address, CAs should retrieve and process CAA records in accordance with RFC 9495.
• Starting on March 15, 2025, prior to issuing a Certificate that includes a Mailbox Address, CAs shall retrieve and process CAA records in accordance with RFC 9495.
• CAs must process the issuemail property tag as specified in RFC 9495.
• Additional property tags may be supported, but must not conflict with or supersede the authorizations in issuemail.
• If a Certificate is issued following a CAA check, it must be issued within the TTL of the CAA record or 8 hours, whichever is greater.
• If a Certificate includes more than one Mailbox Address, the CA must perform the procedure for each Mailbox Address.
• CAA checking is optional for Certificates issued by a Technically Constrained Subordinate CA Certificate when the lack of CAA checking is an explicit contractual provision in the contract with the Technically Constrained Subordinate CA Applicant.
• A CA must not issue a Certificate unless it determines the Certificate Request is consistent with the applicable CAA RRset.
• CAs must log all actions taken, if any, consistent with their CAA processing practice.
• CAs may treat a record lookup failure as permission to issue only if the failure is outside the CA's infrastructure, the lookup has been retried at least once, and the domain's zone does not have a DNSSEC validation chain to the ICANN root.

Document publication

• The new S/MIME BR v.1.0.3 was published to the CABF public website.
• The linked PDF is dated February 20, 2024.
• The GitHub diff shows the new version 1.0.3 and the new applicability dates of September 15, 2024 and March 15, 2025.