CAB Forum

CAB Forum
Name	CAB Forum
Abbreviation	CAB Forum
Formation	2007
Type	Industry forum
Purpose	Harmonize baseline requirements for Certification Authorities and coordinate browser and CA interactions
Headquarters	Global
Region served	Global

CAB Forum

The CAB Forum is an industry consortium of major Google, Microsoft, Apple, Mozilla, Oracle, Cisco, Meta Platforms, Inc., Amazon, DigiCert, Entrust and other stakeholders that develop technical and policy standards for public key infrastructure used by web browsers and digital certificate providers. Founded to align practices among Internet Explorer, Firefox, Chrome, Safari and other client implementations, the organization focuses on interoperability between X.509, TLS, SSL, HTTP/2, and related protocols while engaging with standards bodies such as IETF, Baselining efforts, and ISO workgroups.

Overview

The forum serves as a coordination point between major browser vendors like Google and Mozilla and certificate authorities including DigiCert, Sectigo, Let's Encrypt, GlobalSign, GoDaddy, Symantec legacy operations, Entrust, Izenpe and Actalis to harmonize certificate issuance practices. It issues consensus documents such as the Baseline Requirements and the EV Guidelines, which affect implementations in Microsoft Edge, Apple Safari, Mozilla Firefox, and Google Chrome. The forum interacts with international entities including ENISA and NIST on compliance expectations.

History and Formation

Established in the mid-2000s amid incidents involving misissuance and compromised trust anchors, the organization emerged after high-profile events tied to Comodo, DigiNotar, and controversies impacting Dutch Government and Estonian e-government services. Early participants included browser teams from Mozilla and Google alongside major certificate providers such as VeriSign and Entrust. The formation led to coordinated actions like root program changes in Microsoft and Apple stores and influenced legal and policy debates in jurisdictions such as United States and European Union. Subsequent crises—such as the Heartbleed vulnerability and certificate revocation scale issues—prompted revisions to forum guidelines and accelerated engagement with IETF working groups like ietf-tls.

Membership and Governance

Membership comprises browser vendors, certificate authorities, auditors, and other stakeholders including Adobe Systems, Akamai Technologies, Cloudflare, PayPal Holdings, Stripe, Yubico, Keyfactor, SwissSign Group, IdenTrust and academic observers from institutions such as MIT, Stanford University, University of Cambridge, and ETH Zurich. Governance is typically by consensus with formal ballot processes; participants adopt versions of the Baselining efforts through voting and public comment periods. The forum interfaces with root program operators like the Mozilla Root Program and Microsoft Trusted Root Program, and its outputs influence audit firms including KPMG, PricewaterhouseCoopers, Deloitte, and Ernst & Young which perform WebTrust and ETSI audits.

Policies and Guidelines

Core deliverables include the Baseline Requirements, Extended Validation (EV) Guidelines, and Validation Technical Specification documents that set practices for identity verification, certificate lifecycle, key sizes, and cryptographic algorithms like RSA, ECDSA, and SHA-2. The forum’s guidelines affect browser UI decisions in Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Edge and interact with standards from IETF and ISO/IEC directives. Compliance mechanisms utilize audit criteria from WebTrust and ETSI EN 319 411-1; enforcement can lead to removal from root programs operated by Apple or Microsoft. The forum has incorporated responses to algorithmic deprecations, mandating limits on certificate lifetimes in line with policies adopted by CA/B Forum-aligned programs.

Major Initiatives and Working Groups

Working groups address topics such as Certificate Transparency integration used by Google and Cloudflare, EV policy maintenance affected by CA/Browser Forum EV Guidelines, audit requirements involving WebTrust and ETSI, domain validation automation influenced by Let's Encrypt and ACME Protocol discussions, and post-quantum readiness coordinating with NIST post-quantum cryptography standardization efforts. Initiatives have included abbreviated certificate lifetimes, revocation mechanism improvements with OCSP and CRL behaviors, and the adoption of Certificate Transparency logs run by operators like Google and Cloudflare. Cross-industry collaboration draws participation from IETF, ENISA, NIST, ITU, and regional bodies such as CEN.

Criticisms and Controversies

Critics have argued that the forum’s de facto regulatory role overlaps with national regulators such as Federal Trade Commission and European Commission, raising accountability questions addressed in debates involving ENISA and NIST. Controversies include responses to incidents like the DigiNotar breach and the handling of legacy roots owned by Symantec which led to actions by Google and Mozilla to distrust certain certificates. Some observers from Electronic Frontier Foundation and privacy-focused researchers at University of California, Berkeley have raised concerns about transparency, influence of large vendors like Google and Apple, and the balance between industry self-regulation and statutory oversight in markets including the European Union and the United States of America. Other disputes involved audit standards enforced by firms such as KPMG and PwC and the pace of adopting post-quantum cryptography as recommended by NIST.

Category:Internet security organizations