BR

### 1.2.1 Revisions | **Ver.** | **Ballot** | **Description** | **Adopted** | **Effective\*** | |--------|---------|---------------------------------------------------|---------------|-----------------| | 1.0.0 | 62 | Version 1.0 of the Baseline Requirements Adopted | 22-Nov-11 | 01-Jul-12 | | 1.0.1 | 71 | Revised Auditor Qualifications | 08-May-12 | 01-Jan-13 | | 1.0.2 | 75 | Non-critical Name Constraints allowed as exception to RFC 5280 | 08-Jun-12 | 08-Jun-12 | | 1.0.3 | 78 | Revised Domain/IP Address Validation, High Risk Requests, and Data Sources | 22-Jun-12 | 22-Jun-12 | | 1.0.4 | 80 | OCSP responses for non-issued certificates | 02-Aug-12 | 01-Feb-13 01-Aug-13 | | -- | 83 | Network and Certificate System Security Requirements adopted | 03-Aug-13 | 01-Jan-13 | | 1.0.5 | 88 | User-assigned country code of XX allowed | 12-Sep-12 | 12-Sep-12 | | 1.1.0 | -- | Published as Version 1.1 with no changes from 1.0.5 | 14-Sep-12 | 14-Sep-12 | | 1.1.1 | 93 | Reasons for Revocation and Public Key Parameter checking | 07-Nov-12 | 07-Nov-12 01-Jan-13 | | 1.1.2 | 96 | Wildcard certificates and new gTLDs | 20-Feb-13 | 20-Feb-13 01-Sep-13 | | 1.1.3 | 97 | Prevention of Unknown Certificate Contents | 21-Feb-13 | 21-Feb-13 | | 1.1.4 | 99 | Add DSA Keys (BR v.1.1.4) | 3-May-2013 | 3-May-2013 | | 1.1.5 | 102 | Revision to subject domainComponent language in Section 9.2.3 | 31-May-2013 | 31-May-2013 | | 1.1.6 | 105 | Technical Constraints for Subordinate Certificate Authorities | 29-Jul-2013 | 29-Jul-2013 | | 1.1.7 | 112 | Replace Definition of "Internal Server Name" with "Internal Name" | 3-Apr-2014 | 3-Apr-2014 | | 1.1.8 | 120 | Affiliate Authority to Verify Domain | 5-Jun-2014 | 5-Jun-2014 | | 1.1.9 | 129 | Clarification of PSL mentioned in Section 11.1.3 | 4-Aug-2014 | 4-Aug-2014 | | 1.2.0 | 125 | CAA Records | 14-Oct-2014 | 15-Apr-2015 | | 1.2.1 | 118 | SHA-1 Sunset | 16-Oct-2014 | 16-Jan-2015 1-Jan-2016 1-Jan-2017 | | 1.2.2 | 134 | Application of RFC 5280 to Pre-certificates | 16-Oct-2014 | 16-Oct-2014 | | 1.2.3 | 135 | ETSI Auditor Qualifications | 16-Oct-2014 | 16-Oct-2014 | | 1.2.4 | 144 | Validation Rules for .onion Names | 18-Feb-2015 | 18-Feb-2015 | | 1.2.5 | 148 | Issuer Field Correction | 2-Apr-2015 | 2-Apr-2015 | | 1.3.0 | 146 | Convert Baseline Requirements to RFC 3647 Framework | 16-Apr-2015 | 16-Apr-2015 | | 1.3.1 | 151 | Addition of Optional OIDs for Indicating Level of Validation | 28-Sep-2015 | 28-Sep-2015 | | 1.3.2 | 156 | Amend Sections 1 and 2 of Baseline Requirements | 3-Dec-2015 | 3-Dec-2016 | | 1.3.3 | 160 | Amend Section 4 of Baseline Requirements | 4-Feb-2016 | 4-Feb-2016 | | 1.3.4 | 162 | Sunset of Exceptions | 15-Mar-2016 | 15-Mar-2016 | | 1.3.5 | 168 | Baseline Requirements Corrections (Revised) | 10-May-2016 | 10-May-2016 | | 1.3.6 | 171 | Updating ETSI Standards in CABF documents | 1-Jul-2016 | 1-Jul-2016 | | 1.3.7 | 164 | Certificate Serial Number Entropy | 8-Jul-2016 | 30-Sep-2016 | | 1.3.8 | 169 | Revised Validation Requirements | 5-Aug-2016 | 1-Mar-2017 | | 1.3.9 | 174 | Reform of Requirements Relating to Conflicts with Local Law | 29-Aug-2016 | 27-Nov-2016 | | 1.4.0 | 173 | Removal of requirement to cease use of public key due to incorrect info | 28-Jul-2016 | 11-Sep-2016 | | 1.4.1 | 175 | Addition of givenName and surname | 7-Sep-2016 | 7-Sep-2016 | | 1.4.2 | 181 | Removal of some validation methods listed in Section 3.2.2.4 | 7-Jan-2017 | 7-Jan-2017 | | 1.4.3 | 187 | Make CAA Checking Mandatory | 8-Mar-2017 | 8-Sep-2017 | | 1.4.4 | 193 | 825-day Certificate Lifetimes | 17-Mar-2017 | 1-Mar-2018 | | 1.4.5 | 189 | Amend Section 6.1.7 of Baseline Requirements | 14-Apr-2017 | 14-May-2017 | | 1.4.6 | 195 | CAA Fixup | 17-Apr-2017 | 18-May-2017 | | 1.4.7 | 196 | Define "Audit Period" | 17-Apr-2017 | 18-May-2017 | | 1.4.8 | 199 | Require commonName in Root and Intermediate Certificates | 9-May-2017 | 8-Jun-2017 | | 1.4.9 | 204 | Forbid DTPs from doing Domain/IP Ownership | 11-Jul-2017 | 11-Aug-2017 | | 1.5.0 | 212 | Canonicalise formal name of the Baseline Requirements | 1-Sep-2017 | 1-Oct-2017 | | 1.5.1 | 197 | Effective Date of Ballot 193 Provisions | 1-May-2017 | 2-Jun-2017 | | 1.5.2 | 190 | Add Validation Methods with Minor Corrections | 19-Sep-2017 | 19-Oct-2017 | | 1.5.3 | 214 | CAA Discovery CNAME Errata | 27-Sep-2017 | 27-Oct-2017 | | 1.5.4 | 215 | Fix Ballot 190 Errata | 4‐Oct‐2017 | 5‐Nov‐2017 | | 1.5.5 | 217 | Sunset RFC 2527 | 21‐Dec‐2017 | 9‐Mar‐2018 | | 1.5.6 | 218 | Remove validation methods #1 and #5 | 5‐Feb‐2018 | 9‐Mar‐2018 | | 1.5.7 | 220 | Minor Cleanups (Spring 2018) | 30‐Mar‐2018 | 29‐Apr‐2018 | | 1.5.8 | 219 | Clarify handling of CAA Record Sets with no "issue"/"issuewild" property tag | 10-Apr-2018 | 10-May-2018 | | 1.5.9 | 223 | Update BR Section 8.4 for CA audit criteria | 15-May-2018 | 14-June-2018 | | 1.6.0 | 224 | WhoIs and RDAP | 22-May-2018 | 22-June-2018 | | 1.6.1 | SC6 | Revocation Timeline Extension | 14-Sep-2018 | 14-Oct-2018 | | 1.6.2 | SC12 | Sunset of Underscores in dNSNames | 9-Nov-2018 | 10-Dec-2018 | | 1.6.3 | SC13 | CAA Contact Property and Associated E-mail Validation Methods | 25-Dec-2018 | 1-Feb-2019 | | 1.6.4 | SC14 | Updated Phone Validation Methods | 31-Jan-2019 | 16-Mar-2019 | | 1.6.4 | SC15 | Remove Validation Method Number 9 | 5-Feb-2019 | 16-Mar-2019 | | 1.6.4 | SC7 | Update IP Address Validation Methods | 8-Feb-2019 | 16-Mar-2019 | | 1.6.5 | SC16 | Other Subject Attributes | 15-Mar-2019 | 16-Apr-2019 | | 1.6.6 | SC19 | Phone Contact with DNS CAA Phone Contact v2 | 20-May-2019 | 9-Sep-2019 | | 1.6.7 | SC23 | Precertificates | 14-Nov-2019 | 19-Dec-2019 | | 1.6.7 | SC24 | Fall Cleanup v2 | 12-Nov-2019 | 19-Dec-2019 | | 1.6.8 | SC25 | Define New HTTP Domain Validation Methods v2 | 31-Jan-2020 | 3-Mar-2020 | | 1.6.9 | SC27 | Version 3 Onion Certificates | 19-Feb-2020 | 27-Mar-2020 | | 1.7.0 | SC29 | Pandoc-Friendly Markdown Formatting Changes | 20-Mar-2020 | 4-May-2020 | | 1.7.1 | SC30 | Disclosure of Registration / Incorporating Agency | 13-Jul-2020 | 20-Aug-2020 | | 1.7.1 | SC31 | Browser Alignment | 16-Jul-2020 | 20-Aug-2020 | | 1.7.2 | SC33 | TLS Using ALPN Method | 14-Aug-2020 | 22-Sept-2020 | | 1.7.3 | SC28 | Logging and Log Retention | 10-Sep-2020 | 19-Oct-2020 | | 1.7.3 | SC35 | Cleanups and Clarifications | 9-Sep-2020 | 19-Oct-2020 | | 1.7.4 | SC41 | Reformat the BRs, EVGs, and NCSSRs | 24-Feb-2021 | 5-Apr-2021 | | 1.7.5 | SC42 | 398-day Re-use Period | 22-Apr-2021 | 2-Jun-2021 | | 1.7.6 | SC44 | Clarify Acceptable Status Codes | 30-Apr-2021 | 3-Jun-2021 | | 1.7.7 | SC46 | Sunset the CAA Exception for DNS Operator | 2-Jun-2021 | 12-Jul-2021 | | 1.7.8 | SC45 | Wildcard Domain Validation | 2-Jun-2021 | 13-Jul-2021 | | 1.7.9 | SC47 | Sunset subject:organizationalUnitName | 30-Jun-2021 | 16-Aug-2021 | | 1.8.0 | SC48 | Domain Name and IP Address Encoding | 22-Jul-2021 | 25-Aug-2021 | | 1.8.1 | SC50 | Remove the requirements of 4.1.1 | 22-Nov-2021 | 23-Dec-2021 | | 1.8.2 | SC53 | Sunset for SHA-1 OCSP Signing | 26-Jan-2022 | 4-Mar-2022 | | 1.8.3 | SC51 | Reduce and Clarify Log and Records Archival Retention Requirements | 01-Mar-2022 | 15-Apr-2022 | | 1.8.4 | SC54 | Onion Cleanup | 24-Mar-2022 | 23-Apr-2022 | | 1.8.5 | SC56 | 2022 Cleanup | 25-Oct-2022 | 30-Nov-2022 | | 1.8.6 | SC58 | Require distributionPoint in sharded CRLs | 7-Nov-2022 | 11-Dec-2022 | | 1.8.7 | SC61 | New CRL entries must have a Revocation Reason Code | 1-Apr-2023 | 15-Jul-2023 | | 2.0.0 | SC62 | Certificate Profiles Update | 22-Apr-2023 | 15-Sep-2023 | | 2.0.1 | SC63 | Make OCSP optional, require CRLs, and incentivize automation | 17-Aug-2023 | 15-Mar-2024 | | 2.0.2 | SC66 | 2023 Cleanup | 23-Nov-2023 | 8-Jan-2024 | | 2.0.3 | SC69 | Clarify router and firewall logging requirements | 13-Mar-2024 | 15-Apr-2024 | | 2.0.4 | SC65 | Convert EVGs into RFC 3647 format | 15-Mar-2024 | 15-May-2024 | | 2.0.5 | SC73 | Compromised and weak keys | 3-May-2024 | 1-Jul-2024 | | 2.0.6 | SC75 | Pre-sign linting | 28-Jun-2024 | 6-Aug-2024 | | 2.0.7 | SC67 | Require Multi-Perspective Issuance Corroboration | 2-Aug-2024 | 6-Sep-2024 | | 2.0.8 | SC77 | Update WebTrust Audit name in Section 8.4 and References | 2-Sep-2024 | 2-Oct-2024 | | 2.0.9 | SC78 | Subject organizationName alignment for DBA / Assumed Name | 2-Oct-2024 | 8-Nov-2024 | | 2.1.0 | SC76 | Clarify and improve OCSP requirements | 26-Sep-2024 | 14-Nov-2024 | | 2.1.1 | SC79 | Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate | 30-Sep-2024 | 14-Nov-2024 | | 2.1.2 | SC80 | Strengthen WHOIS lookups and Sunset Methods 3.2.2.4.2 and 3.2.2.4.15 | 7-Nov-2024 | 16-Dec-2024 | | 2.1.3 | SC83 | Winter 2024-2025 Cleanup Ballot | 23-Jan-2025 | 24-Feb-2025 | | 2.1.4 | SC84 | DNS Labeled with ACME Account ID Validation Method | 28-Jan-2025 | 1-Mar-2025 | | 2.1.5 | SC81 | Introduce Schedule of Reducing Validity and Data Reuse Periods | 11-Apr-2025 | 16-May-2025 | \* Effective Date and Additionally Relevant Compliance Date(s)

CS

### 1.2.1 Revisions | **Ver.** | **Ballot** | **Description** | **Effective** | |----------|------------|-------------------------------------------------------------------------------------------------------------------|-------------------| | 1.2 | CSC-1 | Adopt Baseline Requirements version 1.2 | 13 Aug 2019 | | 2.0 | CSC-2 | Adopt combined EV and BR Code Signing Document | 2 Sept 2020 | | 2.1 | CSC-4 | Move deadline for transition to RSA-3072 and SHA-2 timestamp tokens | 7 Nov 2020 | | 2.2 | CSC-7 | Update to merge EV and non-EV clauses | 8 March 2021 | | 2.3 | CSC-8 | Update to Revocation response mechanisms. key protection for EV certificates, and clean-up of 11.2.1 & Appendix B | 2 May 2021 | | 2.4 | CSC-9 | Spring 2021 Clean-up and Clarification | 8 September 2021 | | 2.5 | CSC-10 | WebTrust CSBR v2.0 Audit Criteria | 12 September 2021 | | 2.6 | CSC-11 | Update to log data retention requirements | 3 November 2021 | | 2.7 | CSC-12 | CRL Revocation Date Clarification | 3 December 2021 | | 2.8 | CSC-13 | Update to Subscriber Key Protection Requirements | 6 May 2022 | | 3.0 | CSC-14 | Convert Code Signing Baseline Requirements to RFC 3647 Framework | 29 June 2022 | | 3.1 | CSC-15 | Summer 2022 Clean-up | 19 September 2022 | | 3.2 | CSC-17 | Subscriber Private Key Protection Extension | 28 October 2022 | | 3.3 | CSC-18 | Update Revocation Requirements | 29 June 2023 | | 3.4 | CSC-19 | Remove SSL BR References | 5 September 2023 | | 3.5 | CSC-20 | Restore Version Reference to EV Guidelines | 7 December 2023 | | 3.6 | CSC-21 | Improved signing services requirements | 28 February 2024 | | 3.7 | CSC-22 | High risk changes | 28 February 2024 | | 3.8 | CSC-25 | Import EV Guidelines into the Code Signing Baseline Requirements | 1 August 2024 | | 3.9 | CSC-26 | Timestamping Private Key Protection | 1 August 2024 |

EVG

### 1.2.1 Revisions | **Ver.** | **Ballot** | **Description** | **Adopted** | **Effective\*** | |-|-|-----|--|--| | 1.4.0 | 72 | Reorganize EV Documents | 29 May 2012 | 29 May 2012 | | 1.4.1 | 75 | NameConstraints Criticality Flag | 8 June 2012 | 8 June 2012 | | 1.4.2 | 101 | EV 11.10.2 Accountants | 31 May 2013 | 31 May 2013 | | 1.4.3 | 104 | Domain verification for EV Certificates | 9 July 2013 | 9 July 2013 | | 1.4.4 | 113 | Revision to QIIS in EV Guidelines | 13 Jan 2014 | 13 Jan 2014 | | 1.4.5 | 114 | Improvements to the EV Definitions | 28 Jan 2014 | 28 Jan 2014 | | 1.4.6 | 119 | Remove "OfIncorporation" from OID descriptions in EVG 9.2.5 | 24 Mar 2014 | 24 Mar 2014 | | 1.4.7 | 120 | Affiliate Authority to Verify Domain | 5 June 2014 | 5 June 2014 | | 1.4.8 | 124 | Business Entity Clarification | 5 June 2014 | 5 June 2014 | | 1.4.9 | 127 | Verification of Name, Title and Agency | 17 July 2014 | 17 July 2014 | | 1.5.0 | 126 | Operational Existence | 24 July 2014 | 24 July 2014 | | 1.5.1 | 131 | Verified Method of Communication | 12 Sept 2014 | 12 Sept 2014 | | 1.5.2 | 123 | Reuse of Information | 16 Oct. 2014 | 16 Oct. 2014 | | 1.5.3 | 144 | Validation rules for .onion names | 18 Feb. 2015 | 18 Feb. 2015 | | 1.5.4 | 146 | Convert Baseline Requirements to RFC 3647 Framework | 16 Apr. 2015 | 16 Apr. 2015 | | 1.5.5 | 145 | Operational Existence for Government Entities | 5 Mar. 2015 | 5 Mar. 2015 | | 1.5.6 | 147 | Attorney-Accountant Letter Changes | 25 June 2015 | 25 June 2015 | | 1.5.7 | 151 | Addition of Optional OIDs for Indicating Level of Validation | 28 Sept 2015 | 28 Sept 2015 | | 1.5.8 | 162 | Sunset of Exceptions | 15 Mar 2016 | 15 Mar 2016 | | 1.5.9 | 163 | Fix Errata in EV Guidelines 11.2.1 | 18 Mar 2016 | 18 Mar 2016 | | 1.6.0 | 171 | Updating ETSI Standards | 1 July 2016 | 1 July 2016 | | 1.6.1 | 180 | In EV 11.7.1, removed outdated cross-reference to BR 3.2.2.4(7) | 7 Jan. 2017 | 7 Jan. 2017 | | 1.6.2 | 103 | 825-day Certificate Lifetimes | 17 Mar. 2017 | 17 Mar. 2017 | | 1.6.3 | 198 | .Onion Revisions (declared invalid) | 7 May 2017 | 8 June 2017 | | 1.6.4 | 191 | Clarify Place of Business Information | 23 May 2017 | 23 June 2017 | | 1.6.5 | 201 | .onion Revisions | 8 June 2017 | 8 July 2017 | | 1.6.6 | 192 | Notary revision | 28 June 2017 | 28 July 2017 | | 1.6.7 | 207 | ASN.1 Jurisdiction | 23 October 2017 | 23 November 2017 | | 1.6.8 | 217 | Sunset RFC 2527 | 21 Dec 2017 | 9 Mar 2018 | | 1.6.9 | SC16 | Other Subject Attributes | 15 Mar 2019 | 16 Apr 2019 | | 1.7.0 | SC17 | Alternative registration numbers for EV certificates | 21 May 2019 | 21 June 2019 | | 1.7.1 | SC24 | Fall cleanup v2 | 12 Nov 2019 | 19 Dec 2019 | | 1.7.2 | SC27 | Version 3 Onion Certificates | 19-Feb-2020 | 27-Mar-2020 | | 1.7.3 | SC30 | Disclosure of Registration / Incorporating Agency | 13-Jul-2020 | 20-Aug-2020 | | 1.7.3 | SC31 | Browser Alignment | 16-Jul-2020 | 20-Aug-2020 | | 1.7.4 | SC35 | Cleanups and Clarifications | 9-Sep-2020 | 19-Oct-2020 | | 1.7.5 | SC41 | Reformatting the BRs, EVGs, and NCSSRs | 24-Feb-2021 | 5-Apr-2021 | | 1.7.6 | SC42 | 398-day Re-use Period | 22-Apr-2021 | 2-Jun-2021 | | 1.7.7 | SC47 | Sunset subject:organizationalUnitName | 30-Jun-2021 | 16-Aug-2021 | | 1.7.8 | SC48 | Domain Name and IP Address Encoding | 22-Jul-2021 | 25-Aug-2021 | | 1.7.9 | SC54 | Onion Cleanup | 24-Mar-2022 | 23-Apr-2022 | | 1.8.0 | SC56 | 2022 Cleanup | 25-Oct-2022 | 30-Nov-2022 | | 1.8.1 | SC68 | Allow VATEL and VATXI for organizationIdentifier | 1-Feb-2024 | 4-Mar-2024 | | 2.0.0 | SC65 | Convert EVGs into RFC 3647 format | 15-March-2024 | 15-May-2024 | | 2.0.1 | SC72 | Delete except to policyQualifiers in EVGs; align with BRs by making them NOT RECOMMENDED | 3-April-2024 | 6-May-2024 | \* Effective Date and Additionally Relevant Compliance Date(s)

SMIME

### 1.2.1 Revisions |Version | Ballot | Description | Publication Date\* | |---------|----------|----------------------------------|-----------| | 1.0.0 | SMC01 |Version 1.0 of the S/MIME Baseline Requirements adopted | January 01, 2023 | | 1.0.1 | SMC03 |Clarification and corrections | August 11, 2023 | | 1.0.2 | SMC04 |Addition of ETSI TS 119 411-6 | December 8, 2023 | | 1.0.3 | SMC05 |Introduction of CAA for S/MIME | February 20, 2024 | | 1.0.4 | SMC06 |Post implementation clarification and corrections | May 11, 2024 | | 1.0.5 | SMC07 |Align Logging Requirement and Key Escrow clarification | July 15, 2024 | | 1.0.6 | SMC08 |Deprecate Legacy Generation Profiles and Minor Updates | August 29, 2024 | | 1.0.7 | SMC09 |Update to WebTrust requirements, require linting, minor edits | November 22, 2024 | | 1.0.8 | SMC010 |Introduction of Multi-Perspective Issuance Corroboration | December 22, 2024 | | 1.0.9 | SMC011 |Add EUID as Registration Reference | May 14, 2025 | | 1.0.10 | SMC012 |ACME for S/MIME Automation | July 2, 2025 | \* Publication Date is the date the new version was published following the Intellectual Property Review. | Version| Ballot| Description | Additional
Compliance Date | |-------|--------|--------------------------------------|-----------| | 1.0.0 | SMC01 | Initial implementation date | September 01, 2023| | 1.0.1 | SMC03 | Transition end for Extant S/MIME CAs | September 15, 2024| | 1.0.3 | SMC05 | SHOULD adoption of CAA for S/MIME | September 15, 2024| | 1.0.3 | SMC05 | SHALL adoption of CAA for S/MIME | March 15, 2025| | 1.0.4 | SMC06 | Requirement to check Active status of Legal Entity Applicants | September 15, 2024| | 1.0.6 | SMC08 | S/MIME Subscriber Certificates SHALL NOT be issued using the Legacy Generation profiles | July 15, 2025 | | 1.0.7 | SMC09 | WebTrust audits SHALL include WebTrust for Network Security | April 1, 2025 | | 1.0.7 | SMC09 |SHOULD implement pre-issuance linting of S/MIME Certificates, and SHOULD implement use of Linting in Self-Audits | March 15, 2025 | | 1.0.7 | SMC09 |SHALL implement pre-issuance linting of S/MIME Certificates | September 15, 2025 | | 1.0.8 | SMC010 | SHOULD implement MPIC | March 15, 2025 | | 1.0.8 | SMC010 | SHALL implement MPIC | May 15, 2025 |