数据
CA/B 论坛投票
CA/B 论坛通过投票修改基线要求(Baseline Requirements),所有公开受信任的 TLS 证书都必须遵守。这里用白话解读对网站运维影响最大的投票,并列出全部投票的状态和生效日期。
CA/B 论坛投票是 CA 和浏览器厂商修改 TLS 证书基线要求的方式。服务器证书工作组的投票按 SC-001、SC-002……编号,2018 年以前用 Ballot 193 这样的纯数字编号。各根证书计划强制执行投票结果,一次投票就能改变证书最长能用多久、域名怎么验证;用宝塔面板、acme.sh 或云厂商证书服务的站长同样受约束。
重要投票白话解读
-
SC-098v2:CA 必须遵守 CAA 的账户和验证方法限制
SC-098v2 要求 CA 从 2027-03-15 起遵守 CAA 的 accounturi 和 validationmethods 参数,把签发限定到指定账户或验证方法。
-
SC-097:最后的 SHA-1 签名退出 Web PKI
SC-097 禁止 TLS 证书和 CRL 中残留的所有 SHA-1 签名,并要求从 2026-09-15 起吊销仍有效的 SHA-1 子 CA 证书。
-
SC-090:邮件和电话验证域名 2028 年前全部退场
SC-090 在 2026 到 2028 年间分批废止所有基于邮件、电话的域名和 IP 验证方法,以及易受“交叉”攻击的 IP 地址验证法。
-
SC-086v3:不再为 in-addr.arpa、ip6.arpa 签发证书
SC-086v3 规定从 2026-03-15 起,公开受信任 CA 不得为反向解析区 in-addr.arpa 和 ip6.arpa 下的域名签发 TLS 证书。
-
SC-088v3:用固定的 DNS TXT 记录验证域名
SC-088v3 新增验证方法 3.2.2.4.22:一条与 CA 账户绑定、长期保留的 DNS TXT 记录,每次续期都可复用,不必再改 DNS。
-
SC-092:预证书签名 CA 退役
SC-092 规定从 2026-03-15 起,CA 不得再用专门的预证书签名 CA 为证书透明度签发预证书,简化 CT 日志和监控的证书链处理。
-
SC-089:每家 CA 都要有经过演练的大规模吊销预案
SC-089 要求公开受信任的 TLS CA 制定大规模吊销预案并每年演练,2025-12-01 起须在 CPS 中声明,演练不能吊销真实证书。
-
SC-085v2:CA 查询 CAA 和验证域名时必须校验 DNSSEC
SC-085v2 要求 CA 从 2026-03-15 起,对启用 DNSSEC 的域名,在查询 CAA 和做 DNS 域名验证时校验 DNSSEC 签名。
-
SC-081v3:证书有效期 2029 年降到 47 天
SC-081v3 把公开受信任 TLS 证书最长有效期从 398 天分三步降到 200、100、47 天,域名验证复用期到 2029 年只剩 10 天。
-
SC-084:带 ACME 账户标签的 DNS 验证方法
SC-084 新增一种类似 ACME dns-01 的验证方法,在验证域名前加入账户专属标签,让多家服务商能各自通过 CNAME 验证同一个域名。
-
SC-080v3:基于 WHOIS 的域名验证退场
SC-080v3 规定 CA 只能从 IANA 列出的来源查询 WHOIS 域名联系人,并从 2025 年 7 月起禁用 WHOIS 邮件和电话验证方法 3.2.2.4.2、3.2.2.4.15。
-
SC-076v2:签发后 15 分钟内必须能查到 OCSP
SC-076v2 理清了 OCSP 规则:2025-01-15 起,签发后 15 分钟内 OCSP 必须给出权威应答,并取消了“保留”序列号的概念。
-
SC-075:CA 签发前必须对证书做自动检查
SC-075 要求公开受信任的 TLS CA 从 2025-03-15 起,对每张待签证书做自动 lint 检查,在误签发生前拦下格式错误。
-
SC-067v3:CA 必须从多个网络位置验证域名
SC-067v3 强制要求多视角签发确认(MPIC):域名验证和 CAA 检查要从多个网络位置重复执行,2025 到 2026 年分阶段落地。
-
SC-073:CA 必须拒绝已泄露和弱密钥
SC-073 要求 CA 从 2024 年 11 月起,拒绝为已报告泄露的密钥和已知弱密钥(Debian、ROCA、相近素数)签发证书。
-
SC-063v4:OCSP 改为可选,CRL 改为必需
SC-063v4 让公开 TLS CA 可以不再提供 OCSP,但必须发布 CRL,并定义了有效期不超过 10 天、无需吊销信息的短期证书,2024-03-15 起生效。
-
SC-062v2:为 TLS 证书制定精确的证书配置文件
SC-062v2 把基线要求第 7 节改写为精确的证书、CRL 和 OCSP 配置文件,2023-09-15 起生效(BR 2.0.0 版)。
-
SC-061v4:新的 CRL 条目必须带吊销原因码
SC-061v4 把 Mozilla 的 CRL 吊销原因码规则写进基线要求:2023-07-15 起,吊销 TLS 证书要记录明确的原因码。
-
SC-047v2:TLS 证书里的 OU 字段被取消
SC-047v2 规定 2022-09-01 起签发的公开受信任 TLS 证书,主题中不得包含 organizationalUnitName(OU)字段。
-
SC-042:域名验证复用期从 825 天降到 398 天
SC-042 规定 2021-10-01 起签发的证书,CA 复用域名或 IP 验证结果的期限从 825 天缩短为 398 天,组织信息的 825 天复用期不变。
-
SC-033:TLS-ALPN 验证取代旧的方法 10
SC-033 在 2020 年用基于 RFC 8737(ACME tls-alpn-01)的方法 3.2.2.4.20,取代了定义含糊的 TLS 验证方法 3.2.2.4.10。
-
SC-031:浏览器对齐,398 天上限写进基线要求
SC-031“浏览器对齐”把各根证书计划自行制定的规定写进基线要求,包括 2020-09-01 起 TLS 证书最长 398 天的上限,以及 OCSP 和名称一致性要求。
-
SC-022v2:2019 年未通过的“一年期证书”投票
SC-022v2 提议把 TLS 证书和域名验证复用期限制在一年左右;浏览器全部赞成,但多数 CA 反对,2019 年未获通过。
-
Ballot 193:TLS 证书最长有效期降到 825 天
Ballot 193 把 DV、OV 证书最长有效期从 39 个月缩短到 825 天,验证数据复用期也同样缩短,2018-03-01 起执行。
-
Ballot 187:所有 CA 必须检查 CAA 记录
Ballot 187 要求所有公开受信任的 CA 从 2017-09-08 起在签发前检查 DNS CAA 记录,让域名所有者决定哪些 CA 可以签发。
全部服务器证书投票
cabforum.org 上列出的 249 个投票,按时间倒序。写了解读的链接到本站页面,其余链接到官方页面。
| 投票 | 标题 | 状态 | 日期 | 生效 |
|---|---|---|---|---|
| SC-105 | Remove High Risk language from TLS BR and EVG | 进行中 | 2026-10-28 | – |
| SC-107 | Improve Certificate Problem Reports and Clarify the Meaning of Revocation | 进行中 | 2026-10-21 | – |
| SC-104 | Set presence of AIA extension to SHOULD for Subscriber Certificates | 通过 | 2026-09-03 | 2026-10-04 |
| SC-100 | DNSSEC Clarification and Consolidation | 通过 | 2026-08-06 | 2026-09-07 |
| SC-102 | EV Domain Reuse and Validity Alignment | 通过 | 2026-07-14 | – |
| SC-101v2 | Clarify Authorization Domain Names | 通过 | 2026-07-01 | 2026-08-06 |
| SC-103 | Require EKUs for Cross-Certified Subordinate CAs | 进行中 | 2026-06-23 | – |
| SC-087v2 | Registration Number Improvement for EV Certificates | 通过 | 2026-06-03 | – |
| SC-098v2 | Process RFC 8657 CAA Parameters 解读 | 通过 | 2026-05-13 | 2026-06-16 |
| SC-099 | Improve Recording of Validation Method | 通过 | 2026-04-18 | 2026-05-19 |
| SC-095v3 | Clean-up 2025 | 通过 | 2026-02-27 | 2026-03-31 |
| SC-097 | Sunset all remaining use of SHA-1 signatures in Certificates and CRLs 解读 | 通过 | 2026-01-24 | 2026-02-25 |
| SC-094v2 | DNSSEC exception in email DCV methods | 通过 | 2026-01-15 | 2026-02-16 |
| SC-096 | Carve-out for DNSSEC verification logging requirements | 通过 | 2026-01-14 | 2026-02-17 |
| SC-090 | Gradually sunset all remaining email-based, phone-based, and ‘crossover’ validation methods from Sections 3.2.2.4 and 3.2.2.5 解读 | 通过 | 2025-11-20 | 2026-01-12 |
| SC-091 | Sunset 3.2.2.5.3 Reverse Address Lookup Validation, proposal of new DNS-based validation using Persistent DCV TXT Record for IP addresses | 通过 | 2025-11-12 | 2025-12-16 |
| SC-086v3 | Sunset the Inclusion of IP Reverse Address Domain Names 解读 | 通过 | 2025-11-10 | 2025-12-15 |
| SC-088v3 | DNS TXT Record with Persistent Value DCV Method 解读 | 通过 | 2025-10-09 | 2025-11-10 |
| SC-092 | Sunset use of Precertificate Signing CAs 解读 | 通过 | 2025-09-02 | 2025-11-04 |
| SC-089 | Mass Revocation Planning 解读 | 通过 | 2025-07-22 | 2025-08-25 |
| SC-085v2 | Require Validation of DNSSEC (when present) for CAA and DCV Lookups 解读 | 通过 | 2025-06-18 | 2025-07-21 |
| SC-081v3 | Introduce Schedule of Reducing Validity and Data Reuse Periods 解读 | 通过 | 2025-04-11 | 2025-05-16 |
| SC-071 | Subscriber Agreement and Terms of Use Consolidation | 已取消 | 2025-04-09 | – |
| SC-084 | DNS Labeled with ACME Account ID Validation Method 解读 | 通过 | 2025-01-28 | 2025-03-01 |
| SC-083v3 | Winter 2024-2025 Cleanup Ballot | 通过 | 2025-01-23 | 2025-02-24 |
| SC-082 | Clarify CA Assisted DNS Validation under 3.2.2.4.7 | 未通过 | 2024-11-29 | – |
| SC-080v3 | Sunset the use of WHOIS to identify Domain Contacts and relying DCV Methods 解读 | 通过 | 2024-11-14 | 2024-12-16 |
| SC-079v2 | Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate | 通过 | 2024-10-14 | 2024-11-14 |
| SC-076v2 | Clarify and improve OCSP requirements 解读 | 通过 | 2024-10-14 | 2024-11-14 |
| SC-078 | Subject organizationName alignment for DBA / Assumed Name | 通过 | 2024-10-02 | 2024-11-08 |
| SC-077 | Update WebTrust Audit name in Section 8.4 and References | 通过 | 2024-09-02 | 2024-10-02 |
| SC-075 | Pre-sign linting 解读 | 通过 | 2024-08-05 | 2024-08-06 |
| SC-067v3 | Require domain validation and CAA checks to be performed from multiple Network Perspectives Corroboration 解读 | 通过 | 2024-08-05 | 2024-09-06 |
| SC-073 | Compromised and weak keys 解读 | 通过 | 2024-06-07 | 2024-07-01 |
| SC-074 | Clarify CP/CPS structure according to RFC 3647 | 未通过 | 2024-05-13 | – |
| SC-072 | Delete except to policyQualifiers in EVGs; align with BRs by making them NOT RECOMMENDED | 通过 | 2024-03-25 | – |
| SC-065v2 | Convert EVGs into RFC 3647 format | 通过 | 2024-03-15 | 2024-05-15 |
| SC-069 | Clarify router and firewall logging requirements | 通过 | 2024-03-12 | 2024-04-15 |
| SC-070 | Clarify the use of DTPs for Domain Control Validation | 未通过 | 2024-02-23 | – |
| SC-068 | Allow VATEL and VATXI for organizationIdentifier | 通过 | 2024-02-01 | – |
| SC-066v4 | Fall 2023 Clean up | 通过 | 2023-11-24 | 2024-01-08 |
| SC-063v4 | Make OCSP Optional, Require CRLs, and Incentivize Automation 解读 | 通过 | 2023-07-14 | 2024-03-15 |
| SC-059v2 | Weak key guidance | 未通过 | 2023-07-14 | – |
| SC-064 | Temporary Moratorium on New Certificate Consumer Memberships | 通过 | 2023-06-15 | – |
| SC-062v2 | Certificate profiles update 解读 | 通过 | 2023-03-17 | 2023-09-15 |
| SC-061v4 | New CRL Entries must have a Revocation Reason Code 解读 | 通过 | 2023-03-02 | 2023-07-15 |
| SC-060 | Membership of ZT Browser | 未通过 | 2023-02-01 | – |
| SC-058 | Require distributionPoint in sharded CRLs | 通过 | 2022-11-11 | 2022-12-11 |
| SC-056 | 2022 Cleanup | 通过 | 2022-10-25 | 2022-11-30 |
| SC-054 | Onion Cleanup | 通过 | 2022-03-24 | 2022-04-23 |
| SC-051 | Reduce and Clarify Audit Log and Records Archival Retention Requirements | 通过 | 2022-03-01 | 2022-04-15 |
| SC-053 | Sunset for SHA-1 OCSP Signing | 通过 | 2022-01-26 | 2022-03-04 |
| SC-052v2 | Specify CRL Validity Intervals in Seconds | 撤回/未表决 | 2022-01-01 | – |
| SC-050 | Remove the requirements of section 4.1.1 | 通过 | 2021-11-22 | 2021-12-23 |
| SC-049 | Special Election for Server Certificate Working Group Vice-Chair | 通过 | 2021-09-27 | – |
| SC-048v2 | Domain Name and IP Address Encoding | 通过 | 2021-07-22 | 2021-08-25 |
| SC-047v2 | Sunset subject:organizationalUnitName 解读 | 通过 | 2021-06-30 | 2021-08-16 |
| SC-045 | Wildcard Domain Validation | 通过 | 2021-06-03 | 2021-07-13 |
| SC-046 | Sunset the CAA exception for DNS Operator | 通过 | 2021-06-02 | 2021-07-12 |
| SC-044 | Clarify Acceptable Status Codes | 通过 | 2021-05-01 | 2021-06-03 |
| SC-042 | 398-day Re-use Period 解读 | 通过 | 2021-04-22 | 2021-06-02 |
| SC-043 | Clarify Acceptable Status Codes | 未通过 | 2021-04-08 | – |
| SC-041 | Reformatting the BRs, EVGs, and NCSSRs | 通过 | 2021-02-26 | 2021-04-05 |
| SC-309v3 | Definition of Critical Vulnerability | 通过 | 2021-02-10 | – |
| SC-037 | Election of Server Certificate Working Group Vice Chair | 通过 | 2021-02-10 | – |
| SC-040 | Security Requirements for Air-Gapped CA Systems | 撤回/未表决 | 2021-02-09 | – |
| SC-038 | Alignment of Record Archival | 未通过 | 2020-12-16 | – |
| SC-034 | Account Management | 未知 | 2020-10-04 | – |
| SC-036 | Election of Server Certificate Working Group Chair | 通过 | 2020-09-21 | – |
| SC-028 | Logging and Log Retention | 通过 | 2020-09-10 | 2020-10-19 |
| SC-035 | Cleanups and Clarifications | 通过 | 2020-09-09 | 2020-10-19 |
| SC-033 | TLS Using ALPN Method 解读 | 通过 | 2020-08-14 | 2020-09-22 |
| SC-032 | NCSSRs Zones | 未通过 | 2020-07-23 | – |
| SC-031 | Browser Alignment 解读 | 通过 | 2020-07-16 | 2020-08-20 |
| SC-030v2 | Disclosure of Registration / Incorporating Agency | 通过 | 2020-07-16 | 2020-08-20 |
| SC-029v3 | System Configuration Management | 通过 | 2020-05-07 | 2020-05-04 |
| SC-026v2 | Pandoc-Friendly Markdown Formatting Changes | 通过 | 2020-03-30 | – |
| SC-020 | System Configuration Management | 未通过 | 2020-03-23 | – |
| SC-027v3 | Version 3 Onion Certificates | 通过 | 2020-02-20 | 2020-03-27 |
| SC-025 | Define New HTTP Domain Validation Methods v2 | 通过 | 2020-02-01 | 2020-03-03 |
| SC-023v3 | Precertificates | 通过 | 2019-11-14 | 2019-12-19 |
| SC-024v2 | Fall Cleanup | 通过 | 2019-11-12 | 2019-12-19 |
| SC-021 | The Network and Certificate Systems Security Requirements section 3 (Log Integrity Controls) | 通过 | 2019-10-04 | – |
| SC-022v2 | Reduce Certificate Lifetimes 解读 | 未通过 | 2019-09-10 | – |
| SC-019 | Phone Contact with DNS CAA Phone Contact v2 | 通过 | 2019-05-21 | 2019-09-09 |
| SC-017v7 | Alternative registration numbers for EV certificates | 通过 | 2019-05-21 | – |
| SC-018 | Phone Contact with DNS CAA Phone Contact | 未通过 | 2019-05-01 | – |
| SC-016 | Other Subject Attributes | 通过 | 2019-03-16 | 2019-04-16 |
| SC-007 | Update IP Address Validation Methods | 通过 | 2019-02-09 | 2019-03-16 |
| SC-015 | Remove Validation Method Number 9 | 通过 | 2019-02-01 | 2019-03-16 |
| SC-014 | Updated Phone Validation Methods | 通过 | 2019-02-01 | 2019-03-16 |
| SC-013 | CAA Contact Property and Associated E-mail Validation Methods | 通过 | 2018-12-18 | 2019-02-01 |
| SC-012 | Sunset of Underscores in dNSNames | 通过 | 2018-11-12 | 2018-12-10 |
| SC-004 | CAA Contact Property and Associated E-mail Validation Method | 未通过 | 2018-11-06 | – |
| SC-010 | Establishing the Network Security Subcommittee of the SCWG | 通过 | 2018-10-04 | – |
| SC-009 | Establish the Validation Subcommittee of the SCWG | 通过 | 2018-10-03 | – |
| SC-005 | Election of Wayne Thayer as SCWG Vice Chair | 未知 | 2018-09-26 | – |
| SC-011 | Update ETSI requirements in the SCWG Charter | 撤回/未表决 | 2018-09-24 | – |
| SC-006 | Revocation Timeline Extension | 通过 | 2018-09-14 | 2018-10-14 |
| SC-008 | Election of Dimitris Zacharopoulos as SCWG Chair | 未知 | 2018-09-06 | – |
| SC-003 | Two-Factor Authentication and Password Improvements | 通过 | 2018-08-16 | – |
| SC-001 | [Empty] | 未知 | 2018-08-01 | – |
| SC-002 | Validating Certificates via CAA CONTACT | 未通过 | 2018-07-27 | – |
| Ballot 221 | Two-Factor Authentication and Password Improvements | 未通过 | 2018-05-24 | – |
| Ballot 224 | WHOIS and RDAP | 通过 | 2018-05-22 | 2018-06-22 |
| Ballot 223 | Update BR Section 8.4 for CA audit criteria | 通过 | 2018-05-16 | 2018-06-14 |
| Ballot 222 | Remove “Any other method” for IP Address validation | 撤回/未表决 | 2018-05-15 | – |
| Ballot 219 | Clarify handling of CAA Record Sets with no “issue”/”issuewild” property tag | 通过 | 2018-04-10 | 2018-05-10 |
| Ballot 220 | Minor Cleanups (Spring 2018) | 通过 | 2018-03-30 | 2018-04-29 |
| Ballot 218 | Remove validation methods 1 and 5 | 通过 | 2018-02-05 | 2018-03-09 |
| Ballot 217 | Sunset RFC 2527 | 通过 | 2017-12-21 | 2018-03-09 |
| Ballot 208 | dnQualifiers | 未通过 | 2017-10-26 | – |
| Ballot 207 | ASN.1 Jurisdiction in EV Guidelines | 通过 | 2017-10-23 | – |
| Ballot 209 | EV Liability | 撤回/未表决 | 2017-10-19 | – |
| Ballot 215 | Fix Ballot 190 Errata | 通过 | 2017-10-04 | 2017-11-05 |
| Ballot 213 | Revocation Timeline Extension | 撤回/未表决 | 2017-10-01 | – |
| Ballot 211 | Resolution of Approval for WTCA v2.1 Changes | 撤回/未表决 | 2017-10-01 | – |
| Ballot 214 | CAA Discovery CNAME Errata | 通过 | 2017-09-27 | 2017-10-27 |
| Ballot 190 | Revised Validation Requirements | 通过 | 2017-09-19 | 2017-10-19 |
| Ballot 212 | Canonicalise formal name of the Baseline Requirements | 通过 | 2017-09-01 | 2017-10-01 |
| Ballot 210 | Misc. Changes to the NCSSR | 通过 | 2017-08-31 | – |
| Ballot 202 | Underscore and Wildcard Characters | 未通过 | 2017-07-26 | – |
| Ballot 204 | Forbid DTPs from doing Domain/IP Ownership | 通过 | 2017-07-11 | 2017-08-11 |
| Ballot 192 | Notary Revision | 通过 | 2017-06-28 | – |
| Ballot 201 | .onion Revisions | 通过 | 2017-06-08 | – |
| Ballot 191 | Clarify Place of Business Information | 通过 | 2017-05-23 | – |
| Ballot 199 | Require commonName in Root and Intermediate Certificates | 通过 | 2017-05-09 | 2017-06-08 |
| Ballot 198 | .Onion Revisions | 通过 | 2017-05-08 | – |
| Ballot 197 | Effective Date of Ballot 193 Provisions | 通过 | 2017-05-03 | 2017-06-02 |
| Ballot 196 | Define “Audit Period” | 通过 | 2017-04-17 | 2017-05-18 |
| Ballot 195 | CAA Fixup | 通过 | 2017-04-17 | 2017-05-18 |
| Ballot 189 | Amend Section 6.1.7 of Baseline Requirements | 通过 | 2017-04-13 | 2017-05-14 |
| Ballot 194 | Effective Date of Ballot 193 Provisions | 未知 | 2017-03-20 | – |
| Ballot 193 | 825-day Certificate Lifetimes 解读 | 通过 | 2017-03-17 | 2018-03-01 |
| Ballot 187 | Make CAA Checking Mandatory 解读 | 通过 | 2017-03-08 | 2017-09-08 |
| Ballot 188 | Clarify use of term “CA” in Baseline Requirements | 未通过 | 2017-03-02 | – |
| Ballot 185 | Limiting the Lifetime of Certificates | 未通过 | 2017-02-24 | – |
| Ballot 186 | Limiting the Reuse of Validation Information | 撤回/未表决 | 2017-02-15 | – |
| Ballot 184 | RFC822 Names and otherNames | 撤回/未表决 | 2017-01-15 | – |
| Ballot 182 | Readopting BR 3.2.2.4 (Part 2) | 未通过 | 2017-01-07 | – |
| Ballot 181 | Readopting BR 3.2.2.4 (Part 1) | 通过 | 2017-01-07 | 2017-01-07 |
| Ballot 180 | Readopting the BRs, EVGL, EV Code Signing, and NCSSR Guidelines with Amendments | 通过 | 2017-01-07 | – |
| Ballot 176 | Addition of CNAME verification to domain validation methods | 未知 | 2016-09-15 | – |
| Ballot 175 | Addition of given name and surname | 通过 | 2016-09-07 | 2016-09-07 |
| Ballot 174 | Reform of Requirements Relating to Conflict with Local Laws | 通过 | 2016-08-29 | 2016-11-27 |
| Ballot 169 | Revised Validation Requirements | 通过 | 2016-08-05 | 2017-03-01 |
| Ballot 173 | Removal of requirement to cease use of private key due to incorrect certificate info | 通过 | 2016-07-28 | 2016-09-11 |
| Ballot 171 | Updating the ETSI standards in the CABF documents | 通过 | 2016-07-01 | 2016-07-01 |
| Ballot 170 | Amend Section 5.1 of Baseline Requirements | 未通过 | 2016-06-16 | – |
| Ballot 168 | Baseline Requirement Corrections – revised | 通过 | 2016-05-10 | 2016-05-10 |
| Ballot 167 | Baseline Requirements Corrections | 未通过 | 2016-04-21 | – |
| Ballot 164 | Certificate Serial Number Entropy | 通过 | 2016-03-31 | 2016-09-30 |
| Ballot 163 | Fix Errata in EV Guidelines 11.2.1 | 通过 | 2016-03-18 | – |
| Ballot 162 | Sunset of Exceptions | 通过 | 2016-03-16 | 2016-03-15 |
| Ballot 161 | Notification of incorrect issuance | 未通过 | 2016-02-12 | – |
| Ballot 160 | Amend Section 4 of Baseline Requirements | 通过 | 2016-02-04 | 2016-02-04 |
| Ballot 159 | Amend Section 4 of Baseline Requirements | 未知 | 2016-01-18 | – |
| Ballot 156 | Amend Sections 1 and 2 of Baseline Requirements | 通过 | 2015-12-03 | 2016-12-03 |
| Ballot 154 | Convert to RFC 3647 Framework and GitHub | 通过 | 2015-11-18 | – |
| Ballot 155 | Convert Network and Certificate System Security Requirements to RFC 3647 Framework and GitHub | 撤回/未表决 | 2015-11-15 | – |
| Ballot 153 | Short-Lived Certificates | 未通过 | 2015-11-11 | – |
| Ballot 152 | SHA-1 Deprecation | 撤回/未表决 | 2015-10-15 | – |
| Ballot 151 | Addition of Optional OIDs for Indicating Level of Validation | 通过 | 2015-09-28 | 2015-09-28 |
| Ballot 150 | OID Revisions | 撤回/未表决 | 2015-08-15 | – |
| Ballot 147 | Attorney Accountant Letter Changes | 通过 | 2015-06-25 | – |
| Ballot 146 | Convert Baseline Requirements to RFC 3647 Framework | 通过 | 2015-04-16 | 2015-04-16 |
| Ballot 148 | Issuer Field Correction | 通过 | 2015-04-02 | 2015-04-02 |
| Ballot 145 | Operational Existence for Government Entities | 未知 | 2015-02-19 | – |
| Ballot 144 | Validation rules for .onion names | 未知 | 2015-02-18 | 2015-02-18 |
| Ballot 143 | Formalization of Validation Working Group | 未知 | 2015-02-18 | – |
| Ballot 142 | Elimination of EV Insurance Requirement | 未通过 | 2015-01-19 | – |
| Ballot 141 | Elimination of EV Insurance Requirement; Financial Responsibility for Mis-Issued Certificates | 未通过 | 2015-01-19 | – |
| Ballot 140 | Short-Life Certificates | 撤回/未表决 | 2014-12-01 | – |
| Ballot 133 | Insurance Requirements for EV Issuers | 未通过 | 2014-10-22 | – |
| Ballot 135 | ETSI Auditor Qualifications | 通过 | 2014-10-16 | 2014-10-16 |
| Ballot 134 | Application of RFC 5280 to Pre-certificates | 未知 | 2014-10-16 | 2014-10-16 |
| Ballot 123 | Reuse of Information | 通过 | 2014-10-16 | – |
| Ballot 118 | SHA-1 Sunset | 通过 | 2014-10-16 | 2014-11-16 |
| Ballot 125 | CAA Records | 通过 | 2014-10-14 | 2015-04-15 |
| Ballot 131 | Update to Verified Method of Communication | 通过 | 2014-09-12 | – |
| Ballot 129 | PSL in BR 11.1.3 | 通过 | 2014-08-04 | 2014-08-04 |
| Ballot 126 | Operational Existence | 通过 | 2014-07-24 | – |
| Ballot 127 | Verification of Agency in EV Guidelines 11.7.2 | 通过 | 2014-07-17 | – |
| Ballot 128 | CP Review Working Group | 通过 | 2014-07-09 | – |
| Ballot 124 | Business Entity Clarification | 通过 | 2014-06-05 | – |
| Ballot 120 | Affiliate Authority to Verify Domain | 通过 | 2014-06-05 | 2014-06-05 |
| Ballot 122 | Verified Method of Communication | 未通过 | 2014-05-08 | – |
| Ballot 121 | EV Guidelines Insurance Requirements | 未通过 | 2014-05-07 | – |
| Ballot 112 | Replace Definition of “Internal Server Name” with “Internal Name” | 通过 | 2014-04-03 | 2014-04-03 |
| Ballot 119 | Remove “OfIncorporation” from OID descriptions in EVG 9.2.5 | 通过 | 2014-03-24 | – |
| Ballot 114 | Improvements to the EV Definitions | 通过 | 2014-01-28 | – |
| Ballot 89 | Publish Recommendations for the Processing of EV SSL Certificates v.2 | 通过 | 2014-01-17 | – |
| Ballot 113 | Revision to QIIS in EV Guidelines | 通过 | 2014-01-13 | – |
| Ballot 111 | Accelerate Max Certificate Lifetime Reduction Timetable | 未知 | 2013-12-04 | – |
| Ballot 107 | Removing Version Numbers to WebTrust and ETSI Standards From CABF Guidelines | 未知 | 2013-08-09 | – |
| Ballot 108 | Defining the Scope of the Baseline Requirements | 未知 | 2013-08-06 | – |
| Ballot 106 | Extended Deadline to Prohibit OCSP “Good” Response for Non-Issued Certificates | 未知 | 2013-08-06 | – |
| Ballot 105 | Technical Constraints for Subordinate Certificate Authorities Yielding Broader and Safer PKI Adoption. | 通过 | 2013-07-29 | 2013-07-29 |
| Ballot 104 | EV Domain Validation | 通过 | 2013-07-09 | – |
| Ballot 103 | OCSP AIA and TLS Feature Extension | 未知 | 2013-06-15 | – |
| Ballot 101 | EV 11.10.2 Accountants | 通过 | 2013-06-07 | – |
| Ballot 102 | BR 9.2.3 domainComponent | 通过 | 2013-05-31 | 2013-05-31 |
| Ballot 100 | Extend Deadline – OCSP Good Response | 撤回/未表决 | 2013-05-30 | – |
| Ballot 99 | Add DSA Keys | 通过 | 2013-05-03 | 2013-05-03 |
| Ballot 97 | Prevention of Unknown Certificate Contents | 通过 | 2013-02-21 | 2013-02-21 |
| Ballot 96 | Wildcard Certificates and New gTLDs | 通过 | 2013-02-20 | 2013-02-20 |
| Ballot 92 | Subject Alternative Names | 未通过 | 2012-11-29 | – |
| Ballot 93 | Reasons for Revocation (BR issues 6, 8, 10, 21) | 未知 | 2012-11-07 | 2012-11-07 |
| Ballot 88 | BR_9_2_4_Errata-ISO3166 | 通过 | 2012-09-12 | 2012-09-12 |
| Ballot 86 | Errata plus ISO3166 | 撤回/未表决 | 2012-08-23 | – |
| Ballot 84 | ISO 3166-1 User-assigned codes | 撤回/未表决 | 2012-08-09 | – |
| Ballot 83 | Adopt Network and Certificate System Security Requirements | 通过 | 2012-08-03 | 2013-01-01 |
| Ballot 80 | Response for Non-Issued Certificates | 通过 | 2012-08-02 | 2013-08-02 |
| Ballot 81 | Required Format for Amendments to Existing Standards or Requirements | 撤回/未表决 | 2012-08-01 | – |
| Ballot 69 | Individual Validation Policy | 撤回/未表决 | 2012-07-13 | – |
| Ballot 78 | Updates to Domain and IP Validation, High Risk Requests, and Data Source in the Baseline Requirements | 未知 | 2012-06-15 | 2012-06-22 |
| Ballot 76 | Public Review of Network Security Controls | 通过 | 2012-06-12 | – |
| Ballot 75 | NameConstraints Criticality Flag | 通过 | 2012-06-08 | 2012-06-08 |
| Ballot 74 | Updates to Domain and IP Validation, High Risk Requests, and Data Source in the Baseline Requirements | 未知 | 2012-05-31 | – |
| Ballot 72 | Reorganize EV Documents | 未知 | 2012-05-29 | – |
| Ballot 71 | Auditor Qualification Requirements | 通过 | 2012-05-08 | 2013-01-01 |
| Ballot 68 | No Unknown Contents | 未知 | 2012-05-01 | – |
| Ballot 95 | Guidance on Deprecated Internal Names | 撤回/未表决 | 2012-03-09 | – |
| Ballot 64 | Recognized Existence | 未知 | 2012-02-16 | – |
| Ballot 65 | QIIS Definition Update | 未知 | 2012-02-09 | – |
| Ballot 62 | Adopt Baseline Requirements Draft 50 | 通过 | 2011-11-22 | 2012-07-01 |
| Ballot 61 | Verification Requirements for Parent Subsidiary | 未知 | 2011-06-15 | – |
| Ballot 60 | Verification Requirements for Parent Subsidiary | 未知 | 2011-04-22 | – |
| Ballot 58 | Operational Existence Through Parent Subsidiary | 未知 | 2011-04-08 | – |
| Ballot 57 | Verifying Agency Through Confirmation of Employment Using QIIS or QGIS | 未知 | 2011-04-08 | – |
| Ballot 59 | Public Review of v. 30b of the Baseline Requirements | 撤回/未表决 | 2011-04-04 | – |
| Ballot 56 | QGIS Contact Information | 未知 | 2011-02-21 | – |
| Ballot 55 | Romanization of Japanese Corporate Names | 未知 | 2010-11-19 | – |
| Ballot 54 | EV 1-3 Adoption | 未知 | 2010-11-19 | – |
| Ballot 53 | Contract Signer Self-Asserted Authority | 通过 | 2010-10-12 | – |
| Ballot 52 | Contract Signer Self-Asserted Authority | 撤回/未表决 | 2010-09-23 | – |
| Ballot 51 | Notaries | 未知 | 2010-09-07 | – |
| Ballot 50 | 64-Character “O” Field | 未知 | 2010-09-07 | – |
| Ballot 49 | New Certificate for Existing Subscriber | 未知 | 2010-08-06 | – |
| Ballot 48 | Telephone Number at Place of Business | 未知 | 2010-08-05 | – |
| Ballot 47 | Document Aging | 撤回/未表决 | 2010-07-01 | – |
| Ballot 46 | Audit Report Availability Timing | 未知 | 2010-06-24 | – |
| Ballot 45 | Verification of Authority | 未知 | 2010-04-23 | – |
| Ballot 44 | IFAC Membership | 未知 | 2010-04-23 | – |
| Ballot 43 | Business Categories | 未知 | 2010-04-22 | – |
| Ballot 42 | Principal Individual | 未知 | 2010-04-22 | – |
| Ballot 41 | Auditing Report Publication | 撤回/未表决 | 2010-04-15 | – |
| Ballot 40 | Terms of Use | 未知 | 2010-04-13 | – |
| Ballot 37 | Another QGIS | 未知 | 2010-04-06 | – |
状态取自 cabforum.org 的投票索引;较早的投票取自各投票页面的结果文字,页面没写清楚的标为“未知”。生效日期取自 TLS 基线要求 §1.2.1。“日期”是 cabforum.org 发布该投票公告的日期。
下载数据
- /data/pki/ballots.json — 全部投票:状态、日期和链接
常见问题
CA/B 论坛的投票怎样才算通过?
按论坛章程,证书签发方(CA)投出的票中至少三分之二赞成、证书使用方(浏览器)投出的票中过半数赞成,两类成员各至少一票赞成,并且达到法定人数,投票才通过。
投票通过后马上生效吗?
不会。投票结束后有 30 天的知识产权审查期,之后 BR 文本才生效;很多要求还有各自更晚的执行日期,比如 SC-081v3 规定的 200 天有效期上限从 2026-03-15 起执行。