Data
CA/Browser Forum ballots
The CA/Browser Forum votes on the Baseline Requirements that every publicly trusted TLS certificate must meet. Below are plain-language summaries of the ballots that matter most to site owners, and the full list with status and effective dates.
CA/Browser Forum ballots are votes by CAs and browser makers that change the Baseline Requirements for TLS certificates. Since 2018 Server Certificate Working Group ballots are numbered SC-001, SC-002 and so on; earlier ballots used plain numbers such as Ballot 193. Root programs enforce the results, so one ballot can change how long certificates last or how domains are validated.
Start with SC-081v3, which cuts the maximum certificate lifetime to 47 days by 2029, and see the certificate validity timeline for the bigger picture.
Ballots explained in plain language
-
SC-098v2: CAs must honor CAA accounturi and validationmethods
SC-098v2 makes CAs process the RFC 8657 CAA parameters accounturi and validationmethods from 2027-03-15, so CAA can restrict issuance to one account or method.
-
SC-097: the last SHA-1 signatures leave the Web PKI
SC-097 bans all remaining SHA-1 signatures in TLS certificates and CRLs and orders revocation of unexpired SHA-1 subordinate CAs from 2026-09-15.
-
SC-090: email and phone domain validation phased out by 2028
SC-090 gradually removes all email- and phone-based domain and IP validation methods, plus the 'crossover-prone' IP Address method, between 2026 and 2028.
-
SC-086v3: no certificates for in-addr.arpa and ip6.arpa
SC-086v3 stops publicly trusted CAs from issuing TLS certificates for domain names under the reverse-DNS zones in-addr.arpa and ip6.arpa from 2026-03-15.
-
SC-088v3: a persistent DNS TXT record for domain validation
SC-088v3 adds validation method 3.2.2.4.22: one account-bound DNS TXT record that stays in place and can be reused for every renewal.
-
SC-092: Precertificate Signing CAs are retired
SC-092 stops CAs from using dedicated Precertificate Signing CAs for Certificate Transparency from 2026-03-15, simplifying chains for CT logs and monitors.
-
SC-089: every CA needs a tested mass revocation plan
SC-089 requires publicly trusted TLS CAs to keep and test a mass revocation plan every year and to state it in their CPS from 2025-12-01.
-
SC-085v2: CAs must check DNSSEC on CAA and domain validation
SC-085v2 requires CAs to validate DNSSEC, when a domain has it, on CAA lookups and DNS-based domain validation from 2026-03-15.
-
SC-081v3: TLS certificate lifetimes drop to 47 days by 2029
SC-081v3 cuts the maximum TLS certificate validity from 398 to 200, 100 and finally 47 days, and domain validation reuse to 10 days, by March 2029.
-
SC-084: DNS validation labeled with the ACME account ID
SC-084 adds a DNS validation method like ACME dns-01 but with an account-specific label, so several providers can validate the same domain via CNAME.
-
SC-080v3: WHOIS-based domain validation is sunset
SC-080v3 tightened how CAs find domain contacts via WHOIS and banned the WHOIS email and phone validation methods 3.2.2.4.2 and 3.2.2.4.15 from July 2025.
-
SC-076v2: OCSP answers within 15 minutes of issuance
SC-076v2 clarified OCSP rules: responders must give authoritative answers within 15 minutes of issuance from 2025-01-15, and 'reserved' serials were removed.
-
SC-075: CAs must lint certificates before signing them
SC-075 requires CAs to run automated linting on every to-be-signed TLS certificate from 2025-03-15, catching format errors before they become misissuance.
-
SC-067v3: MPIC, domain validation from multiple networks
SC-067v3 requires Multi-Perspective Issuance Corroboration (MPIC): domain validation and CAA checks repeated from several networks, phased in from 2025 to 2026.
-
SC-073: CAs must reject compromised and weak keys
SC-073 tells CAs to reject certificate requests for keys already reported compromised and for known weak keys (Debian, ROCA, close primes) from November 2024.
-
SC-063v4: OCSP becomes optional, CRLs become mandatory
SC-063v4 made OCSP optional for public TLS CAs, required CRLs for every CA and defined short-lived certificates that need no revocation info.
-
SC-062v2: precise certificate profiles for TLS certificates
SC-062v2 rewrote Section 7 of the Baseline Requirements into exact certificate, CRL and OCSP profiles, normative from 2023-09-15 (BR version 2.0.0).
-
SC-061v4: new CRL entries must carry a revocation reason code
SC-061v4 brought Mozilla's CRL reason code rules into the Baseline Requirements: since 2023-07-15 revoked TLS certificates get a meaningful reason code.
-
SC-047v2: the OU field disappears from TLS certificates
SC-047v2 banned the subject organizationalUnitName (OU) field in publicly trusted TLS certificates issued from 2022-09-01.
-
SC-042: domain validation can be reused for 398 days, not 825
SC-042 cut how long CAs may reuse a domain or IP address validation from 825 to 398 days for certificates issued from 2021-10-01.
-
SC-033: TLS-ALPN validation replaces the old method 10
SC-033 replaced the loosely specified TLS validation method 3.2.2.4.10 with method 3.2.2.4.20 based on RFC 8737 (ACME tls-alpn-01) in 2020.
-
SC-031: Browser Alignment puts the 398-day cap in the BRs
SC-031 copied root program rules into the Baseline Requirements, including the 398-day maximum TLS certificate validity from 2020-09-01.
-
SC-022v2: the failed 2019 vote for one-year certificates
SC-022v2 proposed capping TLS certificates and domain validation reuse at about one year; browsers all voted yes but most CAs voted no, so it failed in 2019.
-
Ballot 193: TLS certificate lifetime capped at 825 days
Ballot 193 cut the maximum lifetime of DV and OV TLS certificates from 39 months to 825 days, and validation data reuse likewise, from 2018-03-01.
-
Ballot 187: CAA checking becomes mandatory for every CA
Ballot 187 made all publicly trusted CAs check DNS CAA records before issuance from 2017-09-08, so domain owners can choose which CAs may issue.
All server certificate ballots
249 ballots listed on cabforum.org, newest first. Ballots with a summary link to our explainer; the rest link to the official page.
| Ballot | Title | Status | Date | Effective |
|---|---|---|---|---|
| SC-105 | Remove High Risk language from TLS BR and EVG | In progress | 2026-10-28 | – |
| SC-107 | Improve Certificate Problem Reports and Clarify the Meaning of Revocation | In progress | 2026-10-21 | – |
| SC-104 | Set presence of AIA extension to SHOULD for Subscriber Certificates | Passed | 2026-09-03 | 2026-10-04 |
| SC-100 | DNSSEC Clarification and Consolidation | Passed | 2026-08-06 | 2026-09-07 |
| SC-102 | EV Domain Reuse and Validity Alignment | Passed | 2026-07-14 | – |
| SC-101v2 | Clarify Authorization Domain Names | Passed | 2026-07-01 | 2026-08-06 |
| SC-103 | Require EKUs for Cross-Certified Subordinate CAs | In progress | 2026-06-23 | – |
| SC-087v2 | Registration Number Improvement for EV Certificates | Passed | 2026-06-03 | – |
| SC-098v2 | Process RFC 8657 CAA Parameters Explained | Passed | 2026-05-13 | 2026-06-16 |
| SC-099 | Improve Recording of Validation Method | Passed | 2026-04-18 | 2026-05-19 |
| SC-095v3 | Clean-up 2025 | Passed | 2026-02-27 | 2026-03-31 |
| SC-097 | Sunset all remaining use of SHA-1 signatures in Certificates and CRLs Explained | Passed | 2026-01-24 | 2026-02-25 |
| SC-094v2 | DNSSEC exception in email DCV methods | Passed | 2026-01-15 | 2026-02-16 |
| SC-096 | Carve-out for DNSSEC verification logging requirements | Passed | 2026-01-14 | 2026-02-17 |
| SC-090 | Gradually sunset all remaining email-based, phone-based, and ‘crossover’ validation methods from Sections 3.2.2.4 and 3.2.2.5 Explained | Passed | 2025-11-20 | 2026-01-12 |
| SC-091 | Sunset 3.2.2.5.3 Reverse Address Lookup Validation, proposal of new DNS-based validation using Persistent DCV TXT Record for IP addresses | Passed | 2025-11-12 | 2025-12-16 |
| SC-086v3 | Sunset the Inclusion of IP Reverse Address Domain Names Explained | Passed | 2025-11-10 | 2025-12-15 |
| SC-088v3 | DNS TXT Record with Persistent Value DCV Method Explained | Passed | 2025-10-09 | 2025-11-10 |
| SC-092 | Sunset use of Precertificate Signing CAs Explained | Passed | 2025-09-02 | 2025-11-04 |
| SC-089 | Mass Revocation Planning Explained | Passed | 2025-07-22 | 2025-08-25 |
| SC-085v2 | Require Validation of DNSSEC (when present) for CAA and DCV Lookups Explained | Passed | 2025-06-18 | 2025-07-21 |
| SC-081v3 | Introduce Schedule of Reducing Validity and Data Reuse Periods Explained | Passed | 2025-04-11 | 2025-05-16 |
| SC-071 | Subscriber Agreement and Terms of Use Consolidation | Cancelled | 2025-04-09 | – |
| SC-084 | DNS Labeled with ACME Account ID Validation Method Explained | Passed | 2025-01-28 | 2025-03-01 |
| SC-083v3 | Winter 2024-2025 Cleanup Ballot | Passed | 2025-01-23 | 2025-02-24 |
| SC-082 | Clarify CA Assisted DNS Validation under 3.2.2.4.7 | Failed | 2024-11-29 | – |
| SC-080v3 | Sunset the use of WHOIS to identify Domain Contacts and relying DCV Methods Explained | Passed | 2024-11-14 | 2024-12-16 |
| SC-079v2 | Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate | Passed | 2024-10-14 | 2024-11-14 |
| SC-076v2 | Clarify and improve OCSP requirements Explained | Passed | 2024-10-14 | 2024-11-14 |
| SC-078 | Subject organizationName alignment for DBA / Assumed Name | Passed | 2024-10-02 | 2024-11-08 |
| SC-077 | Update WebTrust Audit name in Section 8.4 and References | Passed | 2024-09-02 | 2024-10-02 |
| SC-075 | Pre-sign linting Explained | Passed | 2024-08-05 | 2024-08-06 |
| SC-067v3 | Require domain validation and CAA checks to be performed from multiple Network Perspectives Corroboration Explained | Passed | 2024-08-05 | 2024-09-06 |
| SC-073 | Compromised and weak keys Explained | Passed | 2024-06-07 | 2024-07-01 |
| SC-074 | Clarify CP/CPS structure according to RFC 3647 | Failed | 2024-05-13 | – |
| SC-072 | Delete except to policyQualifiers in EVGs; align with BRs by making them NOT RECOMMENDED | Passed | 2024-03-25 | – |
| SC-065v2 | Convert EVGs into RFC 3647 format | Passed | 2024-03-15 | 2024-05-15 |
| SC-069 | Clarify router and firewall logging requirements | Passed | 2024-03-12 | 2024-04-15 |
| SC-070 | Clarify the use of DTPs for Domain Control Validation | Failed | 2024-02-23 | – |
| SC-068 | Allow VATEL and VATXI for organizationIdentifier | Passed | 2024-02-01 | – |
| SC-066v4 | Fall 2023 Clean up | Passed | 2023-11-24 | 2024-01-08 |
| SC-063v4 | Make OCSP Optional, Require CRLs, and Incentivize Automation Explained | Passed | 2023-07-14 | 2024-03-15 |
| SC-059v2 | Weak key guidance | Failed | 2023-07-14 | – |
| SC-064 | Temporary Moratorium on New Certificate Consumer Memberships | Passed | 2023-06-15 | – |
| SC-062v2 | Certificate profiles update Explained | Passed | 2023-03-17 | 2023-09-15 |
| SC-061v4 | New CRL Entries must have a Revocation Reason Code Explained | Passed | 2023-03-02 | 2023-07-15 |
| SC-060 | Membership of ZT Browser | Failed | 2023-02-01 | – |
| SC-058 | Require distributionPoint in sharded CRLs | Passed | 2022-11-11 | 2022-12-11 |
| SC-056 | 2022 Cleanup | Passed | 2022-10-25 | 2022-11-30 |
| SC-054 | Onion Cleanup | Passed | 2022-03-24 | 2022-04-23 |
| SC-051 | Reduce and Clarify Audit Log and Records Archival Retention Requirements | Passed | 2022-03-01 | 2022-04-15 |
| SC-053 | Sunset for SHA-1 OCSP Signing | Passed | 2022-01-26 | 2022-03-04 |
| SC-052v2 | Specify CRL Validity Intervals in Seconds | Withdrawn / not voted | 2022-01-01 | – |
| SC-050 | Remove the requirements of section 4.1.1 | Passed | 2021-11-22 | 2021-12-23 |
| SC-049 | Special Election for Server Certificate Working Group Vice-Chair | Passed | 2021-09-27 | – |
| SC-048v2 | Domain Name and IP Address Encoding | Passed | 2021-07-22 | 2021-08-25 |
| SC-047v2 | Sunset subject:organizationalUnitName Explained | Passed | 2021-06-30 | 2021-08-16 |
| SC-045 | Wildcard Domain Validation | Passed | 2021-06-03 | 2021-07-13 |
| SC-046 | Sunset the CAA exception for DNS Operator | Passed | 2021-06-02 | 2021-07-12 |
| SC-044 | Clarify Acceptable Status Codes | Passed | 2021-05-01 | 2021-06-03 |
| SC-042 | 398-day Re-use Period Explained | Passed | 2021-04-22 | 2021-06-02 |
| SC-043 | Clarify Acceptable Status Codes | Failed | 2021-04-08 | – |
| SC-041 | Reformatting the BRs, EVGs, and NCSSRs | Passed | 2021-02-26 | 2021-04-05 |
| SC-309v3 | Definition of Critical Vulnerability | Passed | 2021-02-10 | – |
| SC-037 | Election of Server Certificate Working Group Vice Chair | Passed | 2021-02-10 | – |
| SC-040 | Security Requirements for Air-Gapped CA Systems | Withdrawn / not voted | 2021-02-09 | – |
| SC-038 | Alignment of Record Archival | Failed | 2020-12-16 | – |
| SC-034 | Account Management | Unknown | 2020-10-04 | – |
| SC-036 | Election of Server Certificate Working Group Chair | Passed | 2020-09-21 | – |
| SC-028 | Logging and Log Retention | Passed | 2020-09-10 | 2020-10-19 |
| SC-035 | Cleanups and Clarifications | Passed | 2020-09-09 | 2020-10-19 |
| SC-033 | TLS Using ALPN Method Explained | Passed | 2020-08-14 | 2020-09-22 |
| SC-032 | NCSSRs Zones | Failed | 2020-07-23 | – |
| SC-031 | Browser Alignment Explained | Passed | 2020-07-16 | 2020-08-20 |
| SC-030v2 | Disclosure of Registration / Incorporating Agency | Passed | 2020-07-16 | 2020-08-20 |
| SC-029v3 | System Configuration Management | Passed | 2020-05-07 | 2020-05-04 |
| SC-026v2 | Pandoc-Friendly Markdown Formatting Changes | Passed | 2020-03-30 | – |
| SC-020 | System Configuration Management | Failed | 2020-03-23 | – |
| SC-027v3 | Version 3 Onion Certificates | Passed | 2020-02-20 | 2020-03-27 |
| SC-025 | Define New HTTP Domain Validation Methods v2 | Passed | 2020-02-01 | 2020-03-03 |
| SC-023v3 | Precertificates | Passed | 2019-11-14 | 2019-12-19 |
| SC-024v2 | Fall Cleanup | Passed | 2019-11-12 | 2019-12-19 |
| SC-021 | The Network and Certificate Systems Security Requirements section 3 (Log Integrity Controls) | Passed | 2019-10-04 | – |
| SC-022v2 | Reduce Certificate Lifetimes Explained | Failed | 2019-09-10 | – |
| SC-019 | Phone Contact with DNS CAA Phone Contact v2 | Passed | 2019-05-21 | 2019-09-09 |
| SC-017v7 | Alternative registration numbers for EV certificates | Passed | 2019-05-21 | – |
| SC-018 | Phone Contact with DNS CAA Phone Contact | Failed | 2019-05-01 | – |
| SC-016 | Other Subject Attributes | Passed | 2019-03-16 | 2019-04-16 |
| SC-007 | Update IP Address Validation Methods | Passed | 2019-02-09 | 2019-03-16 |
| SC-015 | Remove Validation Method Number 9 | Passed | 2019-02-01 | 2019-03-16 |
| SC-014 | Updated Phone Validation Methods | Passed | 2019-02-01 | 2019-03-16 |
| SC-013 | CAA Contact Property and Associated E-mail Validation Methods | Passed | 2018-12-18 | 2019-02-01 |
| SC-012 | Sunset of Underscores in dNSNames | Passed | 2018-11-12 | 2018-12-10 |
| SC-004 | CAA Contact Property and Associated E-mail Validation Method | Failed | 2018-11-06 | – |
| SC-010 | Establishing the Network Security Subcommittee of the SCWG | Passed | 2018-10-04 | – |
| SC-009 | Establish the Validation Subcommittee of the SCWG | Passed | 2018-10-03 | – |
| SC-005 | Election of Wayne Thayer as SCWG Vice Chair | Unknown | 2018-09-26 | – |
| SC-011 | Update ETSI requirements in the SCWG Charter | Withdrawn / not voted | 2018-09-24 | – |
| SC-006 | Revocation Timeline Extension | Passed | 2018-09-14 | 2018-10-14 |
| SC-008 | Election of Dimitris Zacharopoulos as SCWG Chair | Unknown | 2018-09-06 | – |
| SC-003 | Two-Factor Authentication and Password Improvements | Passed | 2018-08-16 | – |
| SC-001 | [Empty] | Unknown | 2018-08-01 | – |
| SC-002 | Validating Certificates via CAA CONTACT | Failed | 2018-07-27 | – |
| Ballot 221 | Two-Factor Authentication and Password Improvements | Failed | 2018-05-24 | – |
| Ballot 224 | WHOIS and RDAP | Passed | 2018-05-22 | 2018-06-22 |
| Ballot 223 | Update BR Section 8.4 for CA audit criteria | Passed | 2018-05-16 | 2018-06-14 |
| Ballot 222 | Remove “Any other method” for IP Address validation | Withdrawn / not voted | 2018-05-15 | – |
| Ballot 219 | Clarify handling of CAA Record Sets with no “issue”/”issuewild” property tag | Passed | 2018-04-10 | 2018-05-10 |
| Ballot 220 | Minor Cleanups (Spring 2018) | Passed | 2018-03-30 | 2018-04-29 |
| Ballot 218 | Remove validation methods 1 and 5 | Passed | 2018-02-05 | 2018-03-09 |
| Ballot 217 | Sunset RFC 2527 | Passed | 2017-12-21 | 2018-03-09 |
| Ballot 208 | dnQualifiers | Failed | 2017-10-26 | – |
| Ballot 207 | ASN.1 Jurisdiction in EV Guidelines | Passed | 2017-10-23 | – |
| Ballot 209 | EV Liability | Withdrawn / not voted | 2017-10-19 | – |
| Ballot 215 | Fix Ballot 190 Errata | Passed | 2017-10-04 | 2017-11-05 |
| Ballot 213 | Revocation Timeline Extension | Withdrawn / not voted | 2017-10-01 | – |
| Ballot 211 | Resolution of Approval for WTCA v2.1 Changes | Withdrawn / not voted | 2017-10-01 | – |
| Ballot 214 | CAA Discovery CNAME Errata | Passed | 2017-09-27 | 2017-10-27 |
| Ballot 190 | Revised Validation Requirements | Passed | 2017-09-19 | 2017-10-19 |
| Ballot 212 | Canonicalise formal name of the Baseline Requirements | Passed | 2017-09-01 | 2017-10-01 |
| Ballot 210 | Misc. Changes to the NCSSR | Passed | 2017-08-31 | – |
| Ballot 202 | Underscore and Wildcard Characters | Failed | 2017-07-26 | – |
| Ballot 204 | Forbid DTPs from doing Domain/IP Ownership | Passed | 2017-07-11 | 2017-08-11 |
| Ballot 192 | Notary Revision | Passed | 2017-06-28 | – |
| Ballot 201 | .onion Revisions | Passed | 2017-06-08 | – |
| Ballot 191 | Clarify Place of Business Information | Passed | 2017-05-23 | – |
| Ballot 199 | Require commonName in Root and Intermediate Certificates | Passed | 2017-05-09 | 2017-06-08 |
| Ballot 198 | .Onion Revisions | Passed | 2017-05-08 | – |
| Ballot 197 | Effective Date of Ballot 193 Provisions | Passed | 2017-05-03 | 2017-06-02 |
| Ballot 196 | Define “Audit Period” | Passed | 2017-04-17 | 2017-05-18 |
| Ballot 195 | CAA Fixup | Passed | 2017-04-17 | 2017-05-18 |
| Ballot 189 | Amend Section 6.1.7 of Baseline Requirements | Passed | 2017-04-13 | 2017-05-14 |
| Ballot 194 | Effective Date of Ballot 193 Provisions | Unknown | 2017-03-20 | – |
| Ballot 193 | 825-day Certificate Lifetimes Explained | Passed | 2017-03-17 | 2018-03-01 |
| Ballot 187 | Make CAA Checking Mandatory Explained | Passed | 2017-03-08 | 2017-09-08 |
| Ballot 188 | Clarify use of term “CA” in Baseline Requirements | Failed | 2017-03-02 | – |
| Ballot 185 | Limiting the Lifetime of Certificates | Failed | 2017-02-24 | – |
| Ballot 186 | Limiting the Reuse of Validation Information | Withdrawn / not voted | 2017-02-15 | – |
| Ballot 184 | RFC822 Names and otherNames | Withdrawn / not voted | 2017-01-15 | – |
| Ballot 182 | Readopting BR 3.2.2.4 (Part 2) | Failed | 2017-01-07 | – |
| Ballot 181 | Readopting BR 3.2.2.4 (Part 1) | Passed | 2017-01-07 | 2017-01-07 |
| Ballot 180 | Readopting the BRs, EVGL, EV Code Signing, and NCSSR Guidelines with Amendments | Passed | 2017-01-07 | – |
| Ballot 176 | Addition of CNAME verification to domain validation methods | Unknown | 2016-09-15 | – |
| Ballot 175 | Addition of given name and surname | Passed | 2016-09-07 | 2016-09-07 |
| Ballot 174 | Reform of Requirements Relating to Conflict with Local Laws | Passed | 2016-08-29 | 2016-11-27 |
| Ballot 169 | Revised Validation Requirements | Passed | 2016-08-05 | 2017-03-01 |
| Ballot 173 | Removal of requirement to cease use of private key due to incorrect certificate info | Passed | 2016-07-28 | 2016-09-11 |
| Ballot 171 | Updating the ETSI standards in the CABF documents | Passed | 2016-07-01 | 2016-07-01 |
| Ballot 170 | Amend Section 5.1 of Baseline Requirements | Failed | 2016-06-16 | – |
| Ballot 168 | Baseline Requirement Corrections – revised | Passed | 2016-05-10 | 2016-05-10 |
| Ballot 167 | Baseline Requirements Corrections | Failed | 2016-04-21 | – |
| Ballot 164 | Certificate Serial Number Entropy | Passed | 2016-03-31 | 2016-09-30 |
| Ballot 163 | Fix Errata in EV Guidelines 11.2.1 | Passed | 2016-03-18 | – |
| Ballot 162 | Sunset of Exceptions | Passed | 2016-03-16 | 2016-03-15 |
| Ballot 161 | Notification of incorrect issuance | Failed | 2016-02-12 | – |
| Ballot 160 | Amend Section 4 of Baseline Requirements | Passed | 2016-02-04 | 2016-02-04 |
| Ballot 159 | Amend Section 4 of Baseline Requirements | Unknown | 2016-01-18 | – |
| Ballot 156 | Amend Sections 1 and 2 of Baseline Requirements | Passed | 2015-12-03 | 2016-12-03 |
| Ballot 154 | Convert to RFC 3647 Framework and GitHub | Passed | 2015-11-18 | – |
| Ballot 155 | Convert Network and Certificate System Security Requirements to RFC 3647 Framework and GitHub | Withdrawn / not voted | 2015-11-15 | – |
| Ballot 153 | Short-Lived Certificates | Failed | 2015-11-11 | – |
| Ballot 152 | SHA-1 Deprecation | Withdrawn / not voted | 2015-10-15 | – |
| Ballot 151 | Addition of Optional OIDs for Indicating Level of Validation | Passed | 2015-09-28 | 2015-09-28 |
| Ballot 150 | OID Revisions | Withdrawn / not voted | 2015-08-15 | – |
| Ballot 147 | Attorney Accountant Letter Changes | Passed | 2015-06-25 | – |
| Ballot 146 | Convert Baseline Requirements to RFC 3647 Framework | Passed | 2015-04-16 | 2015-04-16 |
| Ballot 148 | Issuer Field Correction | Passed | 2015-04-02 | 2015-04-02 |
| Ballot 145 | Operational Existence for Government Entities | Unknown | 2015-02-19 | – |
| Ballot 144 | Validation rules for .onion names | Unknown | 2015-02-18 | 2015-02-18 |
| Ballot 143 | Formalization of Validation Working Group | Unknown | 2015-02-18 | – |
| Ballot 142 | Elimination of EV Insurance Requirement | Failed | 2015-01-19 | – |
| Ballot 141 | Elimination of EV Insurance Requirement; Financial Responsibility for Mis-Issued Certificates | Failed | 2015-01-19 | – |
| Ballot 140 | Short-Life Certificates | Withdrawn / not voted | 2014-12-01 | – |
| Ballot 133 | Insurance Requirements for EV Issuers | Failed | 2014-10-22 | – |
| Ballot 135 | ETSI Auditor Qualifications | Passed | 2014-10-16 | 2014-10-16 |
| Ballot 134 | Application of RFC 5280 to Pre-certificates | Unknown | 2014-10-16 | 2014-10-16 |
| Ballot 123 | Reuse of Information | Passed | 2014-10-16 | – |
| Ballot 118 | SHA-1 Sunset | Passed | 2014-10-16 | 2014-11-16 |
| Ballot 125 | CAA Records | Passed | 2014-10-14 | 2015-04-15 |
| Ballot 131 | Update to Verified Method of Communication | Passed | 2014-09-12 | – |
| Ballot 129 | PSL in BR 11.1.3 | Passed | 2014-08-04 | 2014-08-04 |
| Ballot 126 | Operational Existence | Passed | 2014-07-24 | – |
| Ballot 127 | Verification of Agency in EV Guidelines 11.7.2 | Passed | 2014-07-17 | – |
| Ballot 128 | CP Review Working Group | Passed | 2014-07-09 | – |
| Ballot 124 | Business Entity Clarification | Passed | 2014-06-05 | – |
| Ballot 120 | Affiliate Authority to Verify Domain | Passed | 2014-06-05 | 2014-06-05 |
| Ballot 122 | Verified Method of Communication | Failed | 2014-05-08 | – |
| Ballot 121 | EV Guidelines Insurance Requirements | Failed | 2014-05-07 | – |
| Ballot 112 | Replace Definition of “Internal Server Name” with “Internal Name” | Passed | 2014-04-03 | 2014-04-03 |
| Ballot 119 | Remove “OfIncorporation” from OID descriptions in EVG 9.2.5 | Passed | 2014-03-24 | – |
| Ballot 114 | Improvements to the EV Definitions | Passed | 2014-01-28 | – |
| Ballot 89 | Publish Recommendations for the Processing of EV SSL Certificates v.2 | Passed | 2014-01-17 | – |
| Ballot 113 | Revision to QIIS in EV Guidelines | Passed | 2014-01-13 | – |
| Ballot 111 | Accelerate Max Certificate Lifetime Reduction Timetable | Unknown | 2013-12-04 | – |
| Ballot 107 | Removing Version Numbers to WebTrust and ETSI Standards From CABF Guidelines | Unknown | 2013-08-09 | – |
| Ballot 108 | Defining the Scope of the Baseline Requirements | Unknown | 2013-08-06 | – |
| Ballot 106 | Extended Deadline to Prohibit OCSP “Good” Response for Non-Issued Certificates | Unknown | 2013-08-06 | – |
| Ballot 105 | Technical Constraints for Subordinate Certificate Authorities Yielding Broader and Safer PKI Adoption. | Passed | 2013-07-29 | 2013-07-29 |
| Ballot 104 | EV Domain Validation | Passed | 2013-07-09 | – |
| Ballot 103 | OCSP AIA and TLS Feature Extension | Unknown | 2013-06-15 | – |
| Ballot 101 | EV 11.10.2 Accountants | Passed | 2013-06-07 | – |
| Ballot 102 | BR 9.2.3 domainComponent | Passed | 2013-05-31 | 2013-05-31 |
| Ballot 100 | Extend Deadline – OCSP Good Response | Withdrawn / not voted | 2013-05-30 | – |
| Ballot 99 | Add DSA Keys | Passed | 2013-05-03 | 2013-05-03 |
| Ballot 97 | Prevention of Unknown Certificate Contents | Passed | 2013-02-21 | 2013-02-21 |
| Ballot 96 | Wildcard Certificates and New gTLDs | Passed | 2013-02-20 | 2013-02-20 |
| Ballot 92 | Subject Alternative Names | Failed | 2012-11-29 | – |
| Ballot 93 | Reasons for Revocation (BR issues 6, 8, 10, 21) | Unknown | 2012-11-07 | 2012-11-07 |
| Ballot 88 | BR_9_2_4_Errata-ISO3166 | Passed | 2012-09-12 | 2012-09-12 |
| Ballot 86 | Errata plus ISO3166 | Withdrawn / not voted | 2012-08-23 | – |
| Ballot 84 | ISO 3166-1 User-assigned codes | Withdrawn / not voted | 2012-08-09 | – |
| Ballot 83 | Adopt Network and Certificate System Security Requirements | Passed | 2012-08-03 | 2013-01-01 |
| Ballot 80 | Response for Non-Issued Certificates | Passed | 2012-08-02 | 2013-08-02 |
| Ballot 81 | Required Format for Amendments to Existing Standards or Requirements | Withdrawn / not voted | 2012-08-01 | – |
| Ballot 69 | Individual Validation Policy | Withdrawn / not voted | 2012-07-13 | – |
| Ballot 78 | Updates to Domain and IP Validation, High Risk Requests, and Data Source in the Baseline Requirements | Unknown | 2012-06-15 | 2012-06-22 |
| Ballot 76 | Public Review of Network Security Controls | Passed | 2012-06-12 | – |
| Ballot 75 | NameConstraints Criticality Flag | Passed | 2012-06-08 | 2012-06-08 |
| Ballot 74 | Updates to Domain and IP Validation, High Risk Requests, and Data Source in the Baseline Requirements | Unknown | 2012-05-31 | – |
| Ballot 72 | Reorganize EV Documents | Unknown | 2012-05-29 | – |
| Ballot 71 | Auditor Qualification Requirements | Passed | 2012-05-08 | 2013-01-01 |
| Ballot 68 | No Unknown Contents | Unknown | 2012-05-01 | – |
| Ballot 95 | Guidance on Deprecated Internal Names | Withdrawn / not voted | 2012-03-09 | – |
| Ballot 64 | Recognized Existence | Unknown | 2012-02-16 | – |
| Ballot 65 | QIIS Definition Update | Unknown | 2012-02-09 | – |
| Ballot 62 | Adopt Baseline Requirements Draft 50 | Passed | 2011-11-22 | 2012-07-01 |
| Ballot 61 | Verification Requirements for Parent Subsidiary | Unknown | 2011-06-15 | – |
| Ballot 60 | Verification Requirements for Parent Subsidiary | Unknown | 2011-04-22 | – |
| Ballot 58 | Operational Existence Through Parent Subsidiary | Unknown | 2011-04-08 | – |
| Ballot 57 | Verifying Agency Through Confirmation of Employment Using QIIS or QGIS | Unknown | 2011-04-08 | – |
| Ballot 59 | Public Review of v. 30b of the Baseline Requirements | Withdrawn / not voted | 2011-04-04 | – |
| Ballot 56 | QGIS Contact Information | Unknown | 2011-02-21 | – |
| Ballot 55 | Romanization of Japanese Corporate Names | Unknown | 2010-11-19 | – |
| Ballot 54 | EV 1-3 Adoption | Unknown | 2010-11-19 | – |
| Ballot 53 | Contract Signer Self-Asserted Authority | Passed | 2010-10-12 | – |
| Ballot 52 | Contract Signer Self-Asserted Authority | Withdrawn / not voted | 2010-09-23 | – |
| Ballot 51 | Notaries | Unknown | 2010-09-07 | – |
| Ballot 50 | 64-Character “O” Field | Unknown | 2010-09-07 | – |
| Ballot 49 | New Certificate for Existing Subscriber | Unknown | 2010-08-06 | – |
| Ballot 48 | Telephone Number at Place of Business | Unknown | 2010-08-05 | – |
| Ballot 47 | Document Aging | Withdrawn / not voted | 2010-07-01 | – |
| Ballot 46 | Audit Report Availability Timing | Unknown | 2010-06-24 | – |
| Ballot 45 | Verification of Authority | Unknown | 2010-04-23 | – |
| Ballot 44 | IFAC Membership | Unknown | 2010-04-23 | – |
| Ballot 43 | Business Categories | Unknown | 2010-04-22 | – |
| Ballot 42 | Principal Individual | Unknown | 2010-04-22 | – |
| Ballot 41 | Auditing Report Publication | Withdrawn / not voted | 2010-04-15 | – |
| Ballot 40 | Terms of Use | Unknown | 2010-04-13 | – |
| Ballot 37 | Another QGIS | Unknown | 2010-04-06 | – |
Status comes from the cabforum.org ballot index or, for older ballots, from the result text on each ballot page; "Unknown" means the page didn't state it clearly. Effective dates come from §1.2.1 of the TLS Baseline Requirements. Date = publication date of the ballot post on cabforum.org.
Download the data
- /data/pki/ballots.json — all ballots with status, dates and links
FAQ
How does a CA/B Forum ballot pass?
Under the Forum's bylaws a ballot needs at least two thirds of the votes cast by certificate issuers and more than half of the votes cast by certificate consumers (browsers), at least one yes vote in each group, and a quorum.
Does a passed ballot apply immediately?
No. After the vote there is a 30-day IPR review period; the BR text becomes effective after that, and many requirements carry their own later compliance dates, such as 2026-03-15 for the 200-day validity limit from SC-081v3.