The CA/Browser Forum's Server Certificate Working Group is currently discussing Ballot SC103, titled "Require EKUs for Cross-Certified Subordinate CAs" — a formal rule change that would mandate exactly the kind of Extended Key Usage field that was missing from Let's Encrypt's Generation X-to-Y cross-signs during May's outage. As of the Working Group's most recent meeting, the ballot remains in its Discussion Period rather than a formal vote.
Why this is worth watching even before it passes
The CA/Browser Forum's ballot process moves in public, documented stages — Discussion Period, IPR Review, then a formal vote — and a ballot can sit in discussion for months before (or instead of) reaching a vote. What makes SC103 notable isn't that it's guaranteed to pass, but that it's a direct, traceable industry response to a real, dated incident, not a purely theoretical hardening measure.
The same working group session, a related ballot
The same set of recent minutes also references Ballot SC104, addressing when the AIA (Authority Information Access) extension — the field that helps a client automatically locate a certificate's issuing CA — should be present on subscriber certificates. Between the two, there's a clear pattern: several current ballots are specifically about making certificate-chain metadata more consistently required, rather than "SHOULD" language that individual CAs can interpret loosely.
What this means if you run your own CA infrastructure
If you operate a private CA or manage cross-signing between your own root generations — the same pattern that caused Let's Encrypt's incident — this is worth treating as an early warning regardless of whether SC103 formally passes. The underlying lesson already happened in public: a cross-signed intermediate is only as safe as the metadata it actually carries, and "we've always cross-signed this way" isn't a substitute for checking each new intermediate against current requirements.
Ballots move slowly, on purpose
It's worth being clear-eyed about the timeline here: even once a ballot completes discussion and review, formal Baseline Requirements changes typically include an effective date months out, giving certificate authorities time to actually implement the change rather than breaking issuance on the day a ballot passes. If SC103 does pass, expect a similar phased rollout to the EKU changes covered throughout this year's other SSL News coverage, not an overnight cutover.
This is our own summary and analysis of publicly reported news, written independently — not a reproduction of any single source's article. Where we reference a specific announcement, we link to it or name the organization directly.