Baseline Requirements (BRs)

The Baseline Requirements (BRs), formally the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, are maintained by the CA/Browser Forum and took effect on 2012-07-01. They define how CAs must verify domain control (DCV) and organization identity, which certificate fields and key types are allowed, maximum validity, CAA checking, revocation deadlines and audit obligations.

Why it matters

The BRs are where the dates you plan around are written. Under Ballot SC-081v3, maximum validity is 200 days for certificates issued from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, and DCV data may be reused for 200, 100 and finally 10 days on those same dates. Section 4.9.1.1 requires revocation within 24 hours for reasons such as key compromise and within 5 days for others. Root programs require compliance, and annual audits such as WebTrust test it.

Example

Sections people look up most often:

3.2.2.4   Validation of domain authorization or control (DCV methods)
3.2.2.8   CAA records processing
4.9.1.1   Reasons for revoking a subscriber certificate
6.3.2     Certificate operational periods (maximum validity)
7.1       Certificate profile

Common misconceptions

• The BRs apply to all certificates. They cover publicly trusted TLS server certificates; private CAs, S/MIME and code signing follow separate rules.
• OV and EV certificates may live longer. The validity cap is the same for DV, OV and EV; only the reuse period for organization data differs (398 days).
• The BRs are law. They are an industry standard enforced through browser root programs and audits.