{"id":18210,"date":"2025-01-06T09:57:23","date_gmt":"2025-01-06T14:57:23","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=18210"},"modified":"2025-09-10T12:33:01","modified_gmt":"2025-09-10T16:33:01","slug":"whois-domain-control-validation-will-phase-out-starting-jan-8","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/whois-domain-control-validation-will-phase-out-starting-jan-8\/","title":{"rendered":"WHOIS Domain Control Validation Will Phase Out Starting Jan. 8"},"content":{"rendered":"\n

If you\u2019ve used WHOIS-based validation for your SSL\/TLS certificates, it\u2019s time to change to another validation method ASAP<\/h2>\n\n\n\n

Changes are coming down the pike regarding WHOIS-based domain validation in the first half of 2025.<\/p>\n\n\n\n

In August 2024, researchers at WatchTowr Labs discovered a vulnerability<\/a> relating to use of legacy WHOIS systems for domain control validation (DCV) that industry leaders were concerned could lead to fraudulent email-based validations for SSL\/TLS certificates<\/a>. Although the scope of the specific vulnerability was limited, it brought up questions about the industry\u2019s reliance on certain legacy resources for validation.<\/p>\n\n\n\n

On Dec. 14, the CA\/Browser Forum (CA\/B Forum) adopted a phased sunset for WHOIS-based methods of domain ownership valida<\/a>tion<\/a> after s<\/a>everal months of discussion<\/a>. But what do these changes mean to you as a domain owner and to the certification authorities (CAs) you rely on?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n

An Overview of What\u2019s Happening & a WHOIS DCV End-of-Life Timeline<\/h2>\n\n\n\n
<\/circle><\/line><\/line><\/svg>

Updated Deadline-Related Information from Sectigo<\/p>

Editor\u2019s Note:<\/strong> This article has been updated on Jan. 8, 2025 to include updated information received via email from Sectigo about its phased rollout.<\/p><\/div>\n\n\n\n

Industry leaders will begin a phased elimination of WHOIS-based DCV methods. As a result, the WHOIS protocol<\/a> or HTTPS server query data will no longer be used as a way to 1) identify domain contacts, or 2) verify an entity\u2019s control over a domain.<\/p>\n\n\n\n

Phase One: Jan. 15, 2025<\/h3>\n\n\n\n

Basically, CAs will be prohibited from relying on domain contact info gathered through manual or automated WHOIS lookup methods. The sunsetting will affect three SSL\/TLS security baseline requirements<\/a>: 3.2.2.4.2 (\u201cEmail, Fax, SMS, or Postal Mail to Domain Contact\u201d), 3.2.2.4.12 (\u201cValidating Applicant as a Domain Contact\u201d), and 3.2.2.4.15 (\u201cPhone Contact with Domain Contact\u201d).<\/p>\n\n\n\n

Phase Two: July 15, 2025<\/h3>\n\n\n\n

This is the date by which publicly trusted CAs MUST NOT rely on any WHOIS-related domain validation methods to issue new leaf certificates or allow prior authorization reuse (even during a valid reuse period). In particular, this phase affects SSL\/TLS BRs 3.2.2.4.2 and 3.2.2.4.15.<\/p>\n\n\n\n

But wait, why does the article title say Jan. 8 if the first phase of the baseline requirement changes doesn\u2019t begin until Jan. 15?<\/strong> It\u2019s because some CAs are rolling out the changes ahead of the deadline to avoid any last-minute issues during implementation that could result in revocation.<\/p>\n\n\n\n

Major CAs Are Implementing These Changes Ahead of the Deadlines<\/h3>\n\n\n\n

DigiCert<\/a> and Sectigo<\/a> announced that customers using WHOIS-based DCV methods should migrate to alternative methods ASAP. Here\u2019s an overview of the company\u2019s phased rollout deadlines:<\/p>\n\n\n\n

 <\/td>Sectigo<\/strong><\/td>DigiCert<\/strong><\/td><\/tr>
Phase One<\/td>Jan. 15, 2025<\/strong> \u2014 Sectigo\u2019s first phase of the rollout will involve prohibiting the use of WHOIS-based email validation for .nl<\/em> top-level domains.<\/td>Jan. 8, 2025<\/strong> \u2014 DigiCert will stop supporting manual and HTTPS web-based WHOIS lookups for domain validations and prior use authorizations based on these methods.<\/td><\/tr>
Phase Two<\/td>June 15, 2025<\/strong> \u2014 Sectigo will no longer support WHOIS-based email DCV and will invalidate any pre-existing DCV records. This means no certificates can be issued or re-issued using these unsupported WHOIS-based DCV methods.<\/td>May 8, 2025<\/strong> \u2014 DigiCert will no longer accept automated WHOIS-based domain validations\/IANA referrals for new domain validations. It will, however, still accept WHOIS protocol-based DCVs.<\/td><\/tr>
Phase Three<\/td> <\/td>July 2025<\/strong> \u2014 DigiCert will no longer allow the reuse of existing WHOIS-based domain validations of any kind, regardless of the time left in a reuse period.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Here’s a quick timeline graphic that shows the rollout of these changes:<\/p>\n\n\n\n

\"Timeline
Image caption: A timeline that illustrates the rollout of phased changes to the WHOIS domain control validation methods over the next 6 months.<\/em><\/figcaption><\/figure>\n\n\n\n

For more information about Sectigo’s changes and timeline, keep an eye on Sectigo’s WHOIS Email DCV Deprecation page<\/a> for updates.<\/p>\n\n\n\n

What Does All of This Mean for Your Organization?<\/h2>\n\n\n\n

NOTE:<\/strong> This issue only impacts companies who used WHOIS contact data to get their SSL\/TLS certificates issued.<\/p>\n\n\n\n

This change will have little to no impact for the overwhelming majority of our customers.<\/p>\n\n\n\n

If You Don\u2019t Use WHOIS Data for Domain Control Validation<\/h3>\n\n\n\n

If a method other than WHOIS web-based lookups was used to validate your domain\u2014 for example, DNS TXT records, file validation, or constructed email (e.g., administrator@domain.com) verification \u2014 then this has no impact on you or your certificates. You\u2019re right as rain and you don\u2019t have to worry about any of these changes.<\/p>\n\n\n\n

If You Did Use WHOIS Data for Your Domain Control Validation Process<\/h3>\n\n\n\n

If you used WHOIS-listed email address to validate your domain when getting a website security certificate<\/a>, you\u2019ll need to change validation methods when requesting a new SSL\/TLS certificate. This is true even for customers who are within the allowed prior authorization reuse period.<\/p>\n\n\n\n

The easiest method for most customers will be to use one of the \u201cconstructed\u201d or pre-approved validation email addresses:<\/p>\n\n\n\n