Podcast
Root Causes 45: What Is the CA/Browser Forum?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
October 17, 2019
SSL certificate practices are governed by the rules of the CA/Browser Forum. But what is the CA/Browser Forum, who is in it, and where do they get their authority? If you've ever wondered about questions like these join our hosts as they describe the origins of the CA/Browser Forum and how it operates.
Podcast Transcript
Lightly edited for flow and brevity.
And then the last one, of course, is that every CA is publishing Certificate Practices Statements; where they talk about what they do around their certificates and they go into normally more detail than the BRs and the root store programs do, and there's an expectation that the CAs will follow their publicly visible Certificate Practices Statements, we call them CPS, as a rule, as a practice and that's something that public can look and read and rely on.
So, all three of those together come together to form kind of the set of background rules and expectations for a public certificate.
And then the last one is there's operational requirements. It's things like infrastructure security and physical security. Things along those lines are codified as well and CAs are expected to follow them. All of that coming together forms what we call the Baseline Requirements and, as you said, Baseline Requirements also include response and remediation. So, there's a recognition that if you are a large CA that is issuing millions of certificates a year that maybe theoretically something happens that isn't exactly in alignment with the Baseline Requirements. Under those circumstances, there are actually codified rules for a remedy. So, if a CA becomes aware of a bad certificate, if they're notified of a bad certificate, they have 24 hours to revoke that certificate and presumably replace it with a good one, but revoke it is the key or in extenuating circumstances up to five days. That's also written into the Baseline Requirements. So that's something that CAs are expected to follow.
Now, what could happen is browsers might decide to make this requirement anyway. They have the power to do that. They could say, any cert that is more than 13 months old, I'm just going to distrust. That would have the same de facto result, but it would do it without a passed ballot. So, you know, that's the kind of thing that can happen. That's the kind of thing we keep our eyes our for. And again, in general, just in the spirit of not having chaos and keeping CAs able to be compliant, that's the sort of thing that that I want to discourage, and we'd much rather do things through the CA/Browser Forum as much as we can.

