SSL had the privilege of hosting the 67th CA/Browser Forum Face-to-Face (F2F) meeting at Rice University in Houston from March 10 to 12, 2026. It was at Rice Stadium in 1962, where President John F. Kennedy famously challenged a nation to go to the moon, not because it was easy, but because it was necessary.
That same spirit of ambitious, purposeful progress set the tone for discussions among attendees from across the industry. The group represented auditors, certificate authorities, browsers, certificate consumers, and other PKI-related organizations, which will reshape the future of digital trust.
An Unprecedented Level of Change
Several themes dominated the sessions and hallway conversations alike:
Certificate lifetime reduction and automation – The industry’s move toward shorter certificate lifetimes is already underway, with significant milestones arriving just days ago and more to come in 2027. The Forum reinforced that organizations that resist automation in their certificate lifecycle management will face growing operational risk.
Merkle tree-based certificates – One of the most forward-looking topics to emerge from the meeting, Merkle tree certificates represent a potential architectural shift in how certificate transparency and validation could function at scale. Expect to hear more about this in the months ahead as the concept moves from early discussions to draft proposals.
Client authentication (ClientAuth) – This was arguably the week’s most contested topic. ClientAuth certificates, which authenticate users and devices rather than websites, have become a focus of discussions among browser vendors. The debate over whether browsers or CAs bear responsibility for their governance underscores the importance of the issue to enterprises that rely on them today. Note: As of March 15, 2026, Google Chrome no longer supports root certificates containing the ClientAuth EKU. This change applies only to Chrome, so there is no need for concern about other major root stores or Google services such as Gmail and Google Trust Services.
Mobile Driver’s Licenses (mDLs) – The integration of government-issued digital identity into the PKI ecosystem continues to gain momentum in the United States. mDLs represent a significant opportunity and a simultaneous policy challenge.
European identity frameworks – Regulatory direction in the EU, particularly on eIDAS 2.0 and qualified trust services, remains an active area of interest for organizations navigating cross-border digital identity requirements as they seek clarity.
Code signing transparency – Advancing verifiability and accountability in code signing was another thread woven throughout the week, reflecting broader industry concern about software supply chain integrity.
The Value of Being in the Room
In an industry where communication with a familiar contact can make the difference in a critical situation, that trust has measurable value.
“Being my first CA/B Forum event, the key takeaway for me was meeting a lot of the people we interact with on a daily basis in various forums,” said Dustin Ward, EVP of Technology at SSL. “Whether it be Mozilla or the CA/B Forum itself, fostering those high-level business relationships where we can pick up the phone and call these colleagues directly if something goes awry on the technical side is critical.”
“These events give us the ability to have face-to-face physical interactions and strengthen relationships across the global digital trust industry,” further states Leo Grove, SSL’s President and CEO. “It’s an opportunity for browsers and CAs to collaborate on the decision-making process shaping tomorrow’s policies and affecting the Internet for users worldwide. The CA/B Forum F2F is also an opportunity for us to showcase our involvement and impact on the ecosystem while advocating on behalf of our customers.”
What Comes Next
The pace of change in digital identity, trust, and PKI is not slowing. Certificate automation, post-quantum cryptography (PQC) readiness, identity verification, and transparency frameworks are all rapidly advancing. Organizations that engage with these developments early and maintain relationships within the standards community are better positioned to adapt without disruption.
SSL will continue to share practical guidance on the topics that emerged from this meeting. If any of these topics are directly affecting your organization, we encourage you to reach out to our team directly.
SSL is a publicly trusted certificate authority and an active member of the CA/Browser Forum.