From e5f7e66adcc71f1413490c7865e3ec2f44ee5a9b Mon Sep 17 00:00:00 2001 From: dzacharo Date: Mon, 14 Sep 2026 09:51:08 +0300 Subject: [PATCH 1/3] Clarify surname/givenName for natural person subjects in regards to organizationName --- docs/CSBR.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/CSBR.md b/docs/CSBR.md index 7210e31..bb994c7 100644 --- a/docs/CSBR.md +++ b/docs/CSBR.md @@ -2347,7 +2347,7 @@ d. __Certificate Field:__ Other subject attributes ##### 7.1.4.2.3 Subject distinguished name field - Non-EV Code Signing Certificates a. __Certificate Field:__ `subject:organizationName` (OID 2.5.4.10) - __Required/Optional:__ Required + __Required/Optional:__ Required for Legal Entity Subjects. Optional for Natural Person Subjects if the `subject:givenName` and/or `subject:surname` is not present. __Contents:__ The `subject:organizationName` field MUST contain either the Subject's name or DBA as verified under BR Section 3.2. The CA MAY include information in this field that differs slightly from the verified name, such as common variations or abbreviations, provided that the CA documents the difference and any abbreviations used are locally accepted abbreviations; e.g., if the official record shows "Company Name Incorporated", the CA MAY use "Company Name Inc." or "Company Name". Because subject name attributes for individuals (e.g. `subject:givenName` (2.5.4.42) and `subject:surname` (2.5.4.4)) are not broadly supported by application software, the CA MAY use the `subject:organizationName` field to convey a natural person Subject's name or DBA. The CA MUST have a documented process for verifying that the information included in the `subject:organizationName` field is not misleading to a Relying Party. b. __Certificate Field:__ `subject:streetAddress` (OID: 2.5.4.9) @@ -2370,6 +2370,10 @@ f. __Certificate Field:__ `subject:countryName` (OID: 2.5.4.6) __Required/Optional:__ Required __Contents:__ The `subject:countryName` MUST contain the two-letter ISO 3166-1 country code associated with the location of the Subject verified under BR Section 3.2.2.3. If a Country is not represented by an official ISO 3166-1 country code, the CA MAY specify the ISO 3166-1 user-assigned code of `XX` indicating that an official ISO 3166-1 alpha-2 code has not been assigned. +g. __Certificate Field:__ `subject:givenName` (OID: 2.5.4.42) and/or `subject:surname` (OID: 2.5.4.4) + __Required/Optional:__ Required for Natural Person Subjects if `subject:organizationName` is not present + __Contents:__ If present, the `subject:givenName` field and `subject:surname` field SHALL contain a Natural Person Subject’s name as verified under Section 3.2.3. Subjects with a single legal name SHALL provide the name in the `subject:surname` attribute. + ##### 7.1.4.2.4 Subject distinguished name fields - EV Code Signing Certificates a. __Certificate Field:__ `subject:organizationName` (OID 2.5.4.10) From 537df2c13d808b7fd2af95791036efa8c3043aa3 Mon Sep 17 00:00:00 2001 From: dzacharo Date: Thu, 17 Sep 2026 20:12:06 +0300 Subject: [PATCH 2/3] Address https://github.com/cabforum/code-signing/commit/e5f7e66adcc71f1413490c7865e3ec2f44ee5a9b#r200803811 --- docs/CSBR.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/CSBR.md b/docs/CSBR.md index bb994c7..a90a8c6 100644 --- a/docs/CSBR.md +++ b/docs/CSBR.md @@ -2347,7 +2347,7 @@ d. __Certificate Field:__ Other subject attributes ##### 7.1.4.2.3 Subject distinguished name field - Non-EV Code Signing Certificates a. __Certificate Field:__ `subject:organizationName` (OID 2.5.4.10) - __Required/Optional:__ Required for Legal Entity Subjects. Optional for Natural Person Subjects if the `subject:givenName` and/or `subject:surname` is not present. + __Required/Optional:__ Required for Legal Entity Subjects. Required for Natural Person Subjects if the `subject:givenName` and/or `subject:surname` is not present. Optional for Natural Person Subjects if the `subject:givenName` and/or `subject:surname` is present. __Contents:__ The `subject:organizationName` field MUST contain either the Subject's name or DBA as verified under BR Section 3.2. The CA MAY include information in this field that differs slightly from the verified name, such as common variations or abbreviations, provided that the CA documents the difference and any abbreviations used are locally accepted abbreviations; e.g., if the official record shows "Company Name Incorporated", the CA MAY use "Company Name Inc." or "Company Name". Because subject name attributes for individuals (e.g. `subject:givenName` (2.5.4.42) and `subject:surname` (2.5.4.4)) are not broadly supported by application software, the CA MAY use the `subject:organizationName` field to convey a natural person Subject's name or DBA. The CA MUST have a documented process for verifying that the information included in the `subject:organizationName` field is not misleading to a Relying Party. b. __Certificate Field:__ `subject:streetAddress` (OID: 2.5.4.9) From f9162c5a8ec199bf9273ce2c0766c8d7330e8208 Mon Sep 17 00:00:00 2001 From: Martijn Katerbarg Date: Tue, 27 Oct 2026 09:52:27 +0100 Subject: [PATCH 3/3] Update version and revisions table --- docs/CSBR.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/CSBR.md b/docs/CSBR.md index a90a8c6..c6db534 100644 --- a/docs/CSBR.md +++ b/docs/CSBR.md @@ -1,11 +1,11 @@ --- title: Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates -subtitle: Version 3.11.0 +subtitle: Version 3.12.0 author: - CA/Browser Forum -date: June 16, 2026 +date: November XX, 2026 copyright: | Copyright 2026 CA/Browser Forum @@ -63,6 +63,7 @@ The following Certificate Policy Identifier is reserved for use by CAs as a requ | 3.9 | CSC-26 | Timestamping Private Key Protection | 1 August 2024 | | 3.10 | CSC-31 | Maximum Validity Reduction | 7 November 2025 | | 3.11 | CSC-32 | Mandatory inclusion of a Reserved Policy OID for Subscriber certificates | 15 September 2026 | +| 3.12 | CSC-34 | Clarify Certificate Profile for Individuals | XX November 2026 | ### 1.2.2 Relevant Dates