Huawei and TrustAsia propose ACME extension for Chinese SM2 compliance

This proposal represents a critical technical bridge for multinational streaming entities operating in China, where SM2 cryptographic standards are legally mandated for data in transit. By automating the management of dual-certificate systems, providers can maintain high-frequency certificate rotation and security without the manual overhead typically associated with localized compliance. As the industry moves toward shorter certificate lifespans and automated PKI, this move ensures that localized regulatory requirements do not become a bottleneck for automated CDN and video delivery workflows. Watch for IETF feedback on the 'auth-01' challenge security model in late 2026.

The proposal aligns with China's tightening regulatory environment regarding commercial cryptography. Under the Cryptography Law of the People's Republic of China, which took effect in January 2020, and subsequent Data Security Management Rules effective January 2025, commercial entities are required to use indigenous SM-series algorithms (SM2, SM3, and SM4) for protecting sensitive data. Per HICOM, November 2025, these mandates are increasingly strictly enforced for data in transit, making traditional international standards like RSA and AES insufficient for full legal compliance in the region. This push for ‘technological sovereignty’ has forced infrastructure providers to adapt global protocols for local use cases.

Simultaneously, the global PKI ecosystem is shifting toward a dual-certificate paradigm to address different challenges. Per the IETF, July 2026, there is ongoing standardization for Post-Quantum Traditional (PQ/T) hybrid authentication, which also utilizes two independent certificates to ensure security against quantum computing threats. While the Huawei and TrustAsia draft focuses on localized compliance rather than post-quantum resilience, it utilizes a similar architectural approach by separating signature and encryption functions. This suggests a broader industry trend where systems must accommodate multiple, concurrently valid certificate chains for different functional or regulatory purposes.

Automation through ACME is becoming non-negotiable as certificate validity windows shrink. Per SSL Reminder, January 2026, the CA/Browser Forum has initiated a policy to reduce maximum certificate lifespans, with a first step capping new certificates at 200 days as of March 2026. In this high-rotation environment, manual certificate management for regional compliance like SM2 is no longer viable for large-scale streaming operations. The proposed extension therefore bridges a gap between the mandatory automation of the global web and the specific sovereign requirements of the Chinese market.