SC-075: CAs must lint certificates before signing them

SC-075 makes "lint before you sign" mandatory. Since 2025-03-15 every publicly trusted TLS CA must run an automated linting process on each to-be-signed certificate to test its technical conformity with the Baseline Requirements, so malformed certificates are stopped before they exist.

What changed

SC-075 added §4.3.1.2, "Linting of to-be-signed Certificate content", and a recommendation in §8.7 to lint the samples a CA checks during self-audits. The ballot text explains why: CAs have disclosed many incidents of certificates that violated technical requirements, while the industry has free open-source linters that can catch a wide range of these errors if run before a precertificate is signed. The ballot doesn't mandate a specific tool. It was proposed by HARICA and endorsed by DigiCert and Mozilla.

Effective dates

The BR change took effect on 2024-08-06. Pre-issuance linting has been required since 2025-03-15; linting of self-audit samples is recommended from the same date.

Who is affected

SC-075 directly affects CAs, and through them everyone who has ever had a certificate revoked because of a CA's encoding mistake. Misissued certificates must be revoked within days under the BRs, so fewer misissuances mean fewer surprise replacements.

What to do

Nothing is required from site owners. If you want to see what linters check, decode a certificate with our certificate decoder and compare its fields with the certificate profiles the BRs define.