# What Is Baseline Requirements (BRs)? Definition and Examples

> The Baseline Requirements are the CA/Browser Forum rules every publicly trusted CA must follow when validating, issuing and revoking TLS server certificates.

Source: https://ssl.sh/glossary/baseline-requirements/
Last updated: 2026-11-10

The Baseline Requirements (BRs), formally the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, are maintained by the [CA/Browser Forum](https://ssl.sh/glossary/ca-browser-forum/) and took effect on 2012-07-01. They define how CAs must verify domain control ([DCV](https://ssl.sh/glossary/dcv/)) and organization identity, which certificate fields and key types are allowed, maximum validity, CAA checking, revocation deadlines and audit obligations.

## Why it matters
The BRs are where the dates you plan around are written. Under Ballot SC-081v3, maximum validity is 200 days for certificates issued from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, and DCV data may be reused for 200, 100 and finally 10 days on those same dates. Section 4.9.1.1 requires [revocation](https://ssl.sh/glossary/revocation/) within 24 hours for reasons such as key compromise and within 5 days for others. Root programs require compliance, and annual audits such as [WebTrust](https://ssl.sh/glossary/webtrust/) test it.

## Example
Sections people look up most often:

```text
3.2.2.4   Validation of domain authorization or control (DCV methods)
3.2.2.8   CAA records processing
4.9.1.1   Reasons for revoking a subscriber certificate
6.3.2     Certificate operational periods (maximum validity)
7.1       Certificate profile
```

## Common misconceptions
- **The BRs apply to all certificates.** They cover publicly trusted TLS server certificates; private CAs, S/MIME and code signing follow separate rules.
- **OV and EV certificates may live longer.** The validity cap is the same for DV, OV and EV; only the reuse period for organization data differs (398 days).
- **The BRs are law.** They are an industry standard enforced through browser root programs and audits.

## Related terms

- [CA/B 论坛](https://ssl.sh/zh/glossary/ca-browser-forum/): CA/B 论坛是证书颁发机构与浏览器厂商组成的自愿性行业组织，负责制定公开信任证书必须遵守的基线规则。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [有效期](https://ssl.sh/zh/glossary/validity-period/): 有效期是证书中 notBefore 与 notAfter 两个时间之间的区间，只有在此区间内客户端才会接受这张证书。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。
- [MPIC](https://ssl.sh/zh/glossary/mpic/): MPIC 是要求 CA 从多个网络位置重复进行域名验证和 CAA 检查、只有足够多位置结果一致才签发证书的规则。
- [WebTrust 审计](https://ssl.sh/zh/glossary/webtrust/): WebTrust 审计是由持证审计师依据 CA/B 论坛和根证书计划要求检查 CA 内部控制的审计框架，全称 WebTrust for CAs。