SC-062v2: precise certificate profiles for TLS certificates

SC-062v2 turned the loosely worded certificate rules of the Baseline Requirements into exact profiles. Since 2023-09-15, Section 7 spells out field by field what a publicly trusted root, intermediate and TLS subscriber certificate, CRL and OCSP response must, may and must not contain.

What changed

SC-062v2 turned Section 7 into a set of tables, for example which extended key usages a subscriber certificate may carry, how the Subject Alternative Name is encoded and which extensions are required. Members of the Server Certificate Working Group's Validation Subcommittee spent about three years on the update. According to the ballot it aligns what certificate issuers and consumers expect, reduces confusion caused by an imprecise profile, and promotes consistent implementations. Most changes are clarifications of existing rules in Section 7, but some went further and touched other sections. The ballot was proposed by Google and endorsed by Apple and HARICA, and the changes were published as BR version 2.0.0.

Effective dates

Because a few changes were substantive, the ballot used a single effective date: the new profiles became normative on 2023-09-15.

Who is affected

CAs had to reconfigure their certificate templates. Later ballots build on these profiles, including SC-075, which requires linting against them, and SC-092, which retired one of the profiles. For site owners nothing changed in how certificates are requested or installed.

What to do

No action is needed. If a tool reports an unusual field in a certificate issued before September 2023, it may predate the profiles. Inspect any certificate with the certificate decoder.