https://cabforum.org/2023/07/14/ballot-sc063v4-make-ocsp-optional-require-crls-and-incentivize-automation

MPIC requirements have been in place for some time but we would like to add an advisory that these new requirements can have a significant impact on certificates with a large number of SANS due to the time these checks can take. This is particularly relevant in ACME scenarios where the timeout set by a specific tool may not be compatible with the time needed to run checks. 

We advise that organisations look to minimise the number of SANs used within single certificates. 

The end of life for OCSP and requirement for CRL for revocation information has been progressing for sometime, this date finalises the removal of this information from TCS certificates. 

https://cabforum.org/2023/07/14/ballot-sc063v4-make-ocsp-optional-require-crls-and-incentivize-automation/

No specific action needed but be aware that specific certicate implementations may need to change their default settings in order to not run into errors. 

If your certificate is issued before the deadline, it can still have the current maximum validity (398 days max). However, any certificate issued on or after 15 March 2026 must follow the new 200-day rule – even if the renewal process started earlier.

For Organisation Validation (OV) certificates, the reuse periods for domain and organisation validation are also shortening in line with the certificate lifetimes.

That means even your validation data (like proof of domain control) must be refreshed more frequently, reinforcing the need for automation.

https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/

 Be aware of the changing time limits and work with your organisations to support automation wherever possible. Be aware of further changes to the lifespan in upcoming years. 

CAs complying with the TLS Baseline Requirements are required to validate DNSSEC, when present, in the course of retrieving CAA records or performing DCV-related DNS lookups from Primary Network Perspectives. 

https://cabforum.org/2025/06/18/ballot-sc-085v2-require-validation-of-dnssec-when-present-for-caa-and-dcv-lookups/

No specific action required, just be aware of the potential impacts if CAA records are not correctly set. 

Public TLS certificates are intended solely for server authentication on the open Internet. If they also contain the ClientAuth EKU, they could be misused for purposes that public CAs cannot validate or govern (e.g., authenticating users into enterprise systems).

This does not mean client authentication is going away — it means organisations must use private PKI, enterprise PKI services, or sector-specific solutions instead of public TLS certificates for mTLS. We recommend that TCS "IGTF Client Authentication Certificates" are used for this purpose. 

It is like that use cases will emerge where these EKUs are being actively used and they may not become apparent untl something fails when support is removed. Be aware of this as a potential root cause. 

Some software might be using this as a default aproach - HARICA are aware of some issues with CISCO communication tools and Microsoft Teams.