<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#467886" vlink="#96607D" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt'>2024-04-18 Final Minutes<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Attendees:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Andrea Holland (VikingCloud), Ben Dewberry (Keyfactor), Brian Winters (IdenTrust), Bruce Morton (Entrust), Christophe Bonjean (GlobalSign), Corey Bonnell (DigiCert), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Eva Vansteenberge (GlobalSign), Inaba Atsushi (GlobalSign), Inigo Barreira (Sectigo), Janet Hines (VikingCloud), Marco Schambach (IdenTrust), Martijn Katerbarg (Sectigo), Nome Huang (TrustAsia), Scott Rea (eMudhra), Thomas Zermeno (SSL.com), Tim Crawford (CPA Canada/WebTrust), Wangmo Tenzing (Wangmo Tenzing)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Minute-taker: Corey Bonnell<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Bruce read the note well.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Bruce said he will call for approval of the F2F minutes at the next meeting.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Meeting minutes for the March 21st meeting were approved.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Meeting minutes for the April 4th meeting were approved.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>* Obsolete EVCS guidelines<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Dimitris said the ballot needs to be converted to PDF and circulated on the mailing list.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Bruce said he will take care of that and Corey will publish on the website.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>* Remove EVG references<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Dimitris asked for a review of this draft ballot. He said that a mapping document is<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>available to assist in the review. Martijn and Corey offered to review the PR<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>(<a href="https://url.avanan.click/v2/___https:/github.com/cabforum/code-signing/pull/38___.YXAzOmRpZ2ljZXJ0OmE6bzo2Yjk1MjA2NDAyYWY4YmM5MzU3OGI3ODRkNWY2ZGQ3NDo2OmNiMGU6ZDEzMDg3NzRjMzc5ZDE4YjE5MTZjNDY2ODNhODgxNjIxYTY0OTY4MGMxNDc0MzJmOGRhZTMxNWYwOWM0NjkzOTp0OkY">https://url.avanan.click/v2/___https://github.com/cabforum/code-signing/pull/38___.YXAzOmRpZ2ljZXJ0OmE6bzo2Yjk1MjA2NDAyYWY4YmM5MzU3OGI3ODRkNWY2ZGQ3NDo2OmNiMGU6ZDEzMDg3NzRjMzc5ZDE4YjE5MTZjNDY2ODNhODgxNjIxYTY0OTY4MGMxNDc0MzJmOGRhZTMxNWYwOWM0NjkzOTp0OkY</a>).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>* Change to timestamp requirements<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Martijn said Christophe provided several comments on the PR. Christophe raised a<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>concern that re-issuance of a timestamping ICA would incur the requirement to move<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>the CA private key to offline HSM. Bruce also raised a concern that long-lived<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>timestamping CAs could be stored in online HSMs despite this ballot. Martijn<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>said that we could create an effective date to require CAs to move to offline HSMs,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>but that may be complex.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Dimitris said that moving a key does not eliminate the risk, as it was previously<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>stored in an online HSM. Additionally, keys could have been generated before the<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>effective date in an online state prior to being certified in a certificate.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Martijn said that if a key has been generated online, then it couldn't be said that<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>it was "maintained" in an offline state. Martijn said he can clarify this in the ballot.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Martijn said to resolve the concern about legacy online CAs being used in perpetuity,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>that we could propose a sunset date for issuing end-entity timestamping responder<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>certificates to force a rotation to offline CA keys. Corey agreed with that approach.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>* Other business<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Martijn said a ballot for modifying logging requirements in the TLS BRs. He'd like<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>to align the CS BRs with this language. He will write a ballot to do this and will<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>call for endorsers.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Martijn also mentioned that we could remove the EVCS JOI fields and replace with<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>the orgId, as is done in the SMBRs, but said it might be too early for that change.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Bruce said we should reconsider all subject fields in light of the deprecation of<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>EV CS. Dimitris agreed and said that we need to incorporate Microsoft's plans<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>on the validation level of code signing certificates.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Next meeting is May 2nd. Meeting adjourned.<o:p></o:p></span></p></div></body></html>