# What Is CA/Browser Forum (CA/B Forum)? Definition and Examples

> The CA/Browser Forum is a voluntary consortium of certificate authorities and browser vendors that sets baseline rules for publicly trusted certificates.

Source: https://ssl.sh/glossary/ca-browser-forum/
Last updated: 2026-11-10

The CA/Browser Forum (CA/B Forum), founded in 2005, brings together certificate issuers (CAs) and certificate consumers (browser and operating-system vendors) to agree on industry rules. Its Server Certificate Working Group maintains the [Baseline Requirements](https://ssl.sh/glossary/baseline-requirements/) for TLS certificates and the Extended Validation Guidelines; other working groups cover S/MIME and code signing. Changes are made through numbered ballots, published at [cabforum.org](https://cabforum.org/).

## Why it matters
Most rules a site operator feels come from Forum ballots. Ballot SC-081v3 (vote ended 2025-04-11) cuts maximum TLS validity to 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15. Ballot SC-063 made CRLs mandatory and OCSP optional, and Ballot SC-067 introduced [multi-perspective issuance corroboration](https://ssl.sh/glossary/mpic/). The Forum itself enforces nothing: its rules bite because browser [root programs](https://ssl.sh/glossary/root-program/) require CAs to follow them and auditors check compliance.

## Example
Tracing one requirement: a certificate issued on 2026-04-01 may not exceed 200 days of validity.

```text
Rule written in:   Baseline Requirements (adopted via Ballot SC-081v3)
Enforced by:       root programs such as Chrome's, Mozilla's and Apple's
Verified by:       the CA's annual audit
```

## Common misconceptions
- **The CA/B Forum is a government or standards body like the IETF.** It is an industry consortium; its documents bind CAs through root program policies and audits.
- **Browsers cannot act without a ballot.** Root programs can impose stricter rules on their own, as Apple did with the 398-day limit in 2020 before Ballot SC31.
- **Only CAs vote.** Certificate consumers such as browser vendors vote too, and a ballot needs support from both groups to pass.

## Related terms

- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [有效期](https://ssl.sh/zh/glossary/validity-period/): 有效期是证书中 notBefore 与 notAfter 两个时间之间的区间，只有在此区间内客户端才会接受这张证书。
- [MPIC](https://ssl.sh/zh/glossary/mpic/): MPIC 是要求 CA 从多个网络位置重复进行域名验证和 CAA 检查、只有足够多位置结果一致才签发证书的规则。
- [WebTrust 审计](https://ssl.sh/zh/glossary/webtrust/): WebTrust 审计是由持证审计师依据 CA/B 论坛和根证书计划要求检查 CA 内部控制的审计框架，全称 WebTrust for CAs。