Meeting Minutes: Board and BAC Monthly (2026-11-09)

Below are the minutes from the recent BAC and Board of Directors meeting. Your input helps us ensure the OpenSSL community remains transparent, collaborative, and responsive to your needs.

### Attendees

Anton Arapov (Board), Chris Ward (Community Manager), Billy Brumley (Academics), Jaroslav Reznik (Distributions), Jeff Johnson (Large Businesses), Paul Yang (Committers), Randall Becker (Individuals)

Absent: Tim Hudson (Board)

### High-level topics covered

- Governance update

- Closing the loop between the Board and the BAC

- Communities platform: General Discussions

- NSF project update

- CRA, FIPS 140-3 and Common Criteria

- 2027 face-to-face meetings and FOSDEM

- Upcoming events

### Detailed points and discussion

#### 1) Governance update

Tim stepped down as President and Anton is now President; he remains Director and CEO and is in the board of directors.

#### 2) Closing the loop between the Board and the BAC

The group discussed how decisions and documentation reach the community, for example the FIPS_mode() decision. Randall asked to see communications whenever the Board needs BAC feedback or community participation, in both directions. The OpenSSL 5.0 plans thread was suggested as an example. Chris will draft documentation and examples of how community feedback reaches the Board and how the loop is closed.

#### 3) Communities platform: General Discussions

The proposal is to close General Discussions and make the top-level Communities group a moderated room for cross-community topics. New topics there could be created by admins and TAC and BAC delegates. Dmitry raised the concern that cross-community topics are hard to raise. Members can already subscribe (read only) to any community without joining. The group liked the idea of shared topics, where several communities contribute to one topic without cross-posting. Chris will prepare a feature spec for feedback. Needs further discussion. See: https://openssl-communities.org/d/RqBbS2vh/proposal-migrate-general-discussion-to-the-top-level-communities-group

#### 4) NSF project update

Billy reported on three groups of students:

- a paid thesis capstone;

- a bachelor capstone on an authenticated encryption interface, blocked for a couple of weeks by code migrations and slow review (the pull request is merged and the work is unblocked);

- the NSF project itself, with bi-weekly meetings among the PIs.

Billy also asked whether the OpenSSL Corporation is interested in joining the RIT submission to the NSF PESOSE program (Pathways to Enable Secure Open Source Ecosystems), an Academics community matter. To raise visibility, pull request titles should carry the NSF tag; Neil prepared a development board.

#### 5) CRA, FIPS 140-3 and Common Criteria

CRA: The review is in progress and an opinion is being sought from legal counsel. The current plan is Foundation as steward and Corporation as vendor.

FIPS 140-3: The validation is in the fifth round of comments, waiting on NIST, and the NIST review is blocked. Jeff asked for the status of FIPS provider 3.5, including rumours of ML-DSA concerns or CMVP issues, and whether there is any plan or demand for a static FIPS provider (Apple was mentioned). Jeff will reach out to his contacts to help move it forward. iOS and Android support (a static FIPS provider) needs a sponsoring client.

Common Criteria: Anton met BSI at it-sa and there is interest in working together on Common Criteria; companies are being gathered to sponsor the initiative. Before estimating cost, the group first needs to know what is needed, for example from the European Commission and from Large Businesses (Jeff to ask what Cisco needs). Jaroslav has run more than 10 Common Criteria evaluations and offered to help.

#### 6) 2027 face-to-face meetings and FOSDEM

The Distributions meetup at FOSDEM has full interest, and CentOS Connect is around the same dates (Jaroslav). A May face-to-face was proposed; the date should be locked by the next meeting. Randall proposed a Toronto meeting for the advisory committees in April, between RSA and ICMC; he may have a conflict on April 19–25. Chris will run a poll for the best date. Jeff is interested in a Large Businesses face-to-face and will report back after the LBC call on November 10. Billy will poll the Academics community. See: https://openssl-communities.org/p/z0yeaS9i/community-f2f-2027-toronto-in-april-brno-in-may-or-both-

#### 7) Polls and upcoming events

Jeff noted the UPKI poll will be discussed at the LBC call tomorrow. Paul is preparing an agenda for the Hong Kong visit in November/December. OpenSSL team also plans to be at the PKI Consortium conference in Amsterdam.

### Action items

- Billy Brumley: Poll the Academics community on interest in the FOSDEM and face-to-face meetings. Check in next meeting

- Billy Brumley: Add the NSF tag to pull request titles. Ongoing

- Jeff Johnson: Reach out to contacts to help move the NIST review forward. Check in next meeting

- Jeff Johnson: Write up what Large Businesses need for Common Criteria. Check in next meeting

- Jeff Johnson: Raise face-to-face interest and the UPKI poll at the LBC call; review the UPKI support issue with Clemens. After LBC call (Nov 10)

- Anton Arapov: Discuss Common Criteria evaluation paths with Jaroslav. Check in next meeting

- Chris Ward: Circulate dates for 2027 industry events. Check in next meeting

- Chris Ward: Draft documentation and examples of how community feedback reaches the Board and how the loop is closed; share with the group. Check in next meeting

- Chris Ward: Open a proposal thread on General Discussions and the moderated Communities group. Check in next meeting

- Chris Ward: Run a poll to find the best date for the 2027 face-to-face meetings; lock the May date. By next meeting