中文

Glossary

CA/Browser Forum (CA/B Forum)

Last verified

Definition

The CA/Browser Forum is a voluntary consortium of certificate authorities and browser vendors that sets baseline rules for publicly trusted certificates.

The CA/Browser Forum (CA/B Forum), founded in 2005, brings together certificate issuers (CAs) and certificate consumers (browser and operating-system vendors) to agree on industry rules. Its Server Certificate Working Group maintains the Baseline Requirements for TLS certificates and the Extended Validation Guidelines; other working groups cover S/MIME and code signing. Changes are made through numbered ballots, published at cabforum.org.

Why it matters

Most rules a site operator feels come from Forum ballots. Ballot SC-081v3 (vote ended 2025-04-11) cuts maximum TLS validity to 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15. Ballot SC-063 made CRLs mandatory and OCSP optional, and Ballot SC-067 introduced multi-perspective issuance corroboration. The Forum itself enforces nothing: its rules bite because browser root programs require CAs to follow them and auditors check compliance.

Example

Tracing one requirement: a certificate issued on 2026-04-01 may not exceed 200 days of validity.

Rule written in:   Baseline Requirements (adopted via Ballot SC-081v3)
Enforced by:       root programs such as Chrome's, Mozilla's and Apple's
Verified by:       the CA's annual audit

Common misconceptions

  • The CA/B Forum is a government or standards body like the IETF. It is an industry consortium; its documents bind CAs through root program policies and audits.
  • Browsers cannot act without a ballot. Root programs can impose stricter rules on their own, as Apple did with the 398-day limit in 2020 before Ballot SC31.
  • Only CAs vote. Certificate consumers such as browser vendors vote too, and a ballot needs support from both groups to pass.

See also