SC-092: Precertificate Signing CAs are retired

SC-092 removes an optional and rarely used piece of Certificate Transparency: the Precertificate Signing CA. Since 2026-03-15, precertificates that are logged to CT must be signed directly by the issuing CA, not by a separate intermediate dedicated to that job.

What changed

SC-092 sunsets the BR profile for Precertificate Signing CAs. Before a certificate is issued, the CA logs a "precertificate" to CT logs to obtain SCTs. RFC 6962 allowed an extra intermediate, technically constrained to sign only precertificates, and SC-062v2 added a BR profile for it. The ballot gives three reasons: such CAs force every CT log and monitor to support a second, different chain-building logic; adoption stayed low; and the extra complexity contributed to a real operational failure that ended with a CT log being rejected. RFC 9162, CT version 2.0, had already deprecated the mechanism.

Effective dates

The BR change took effect on 2025-11-04. From 2026-03-15 CAs must not use Precertificate Signing CAs to issue precertificates and must not issue certificates with the corresponding profile.

Who is affected

SC-092 affects the few CAs that used this design, CT log operators and certificate monitors. Website owners see no difference: certificates still carry SCTs and browsers check CT as before.

What to do

Site operators need to do nothing. If you run CT monitoring or a CT search tool, you can expect precertificates issued after 2026-03-15 to chain directly to the issuing CA.