Members vote by ballot in two classes, certificate issuers and certificate consumers (Apple, Google, Microsoft, Mozilla and others), and a ballot needs a two-thirds majority of issuers and a majority of consumers. Working groups cover server certificates (the TLS Baseline Requirements and EV Guidelines), S/MIME, code signing and network security.
Recent ballots shaped current practice: SC-063 (2023) made OCSP optional and CRLs mandatory from 15 March 2024; SC-067 (2024) required multi-perspective validation from 15 March 2025; SC-081v3 (2025) cut TLS certificate lifetimes to 47 days by 2029.
The Forum does not enforce anything itself; root programs do, by requiring compliance and audits as a condition of trust, and they can impose stricter rules on their own (Chrome's CT and EKU policies, Apple's 398-day limit in 2020).