On August 1, a couple of new changes to the baseline requirements that govern the issuance of digital certificates went into effect. Certificate Authorities are no longer allowed to use methods #1 and #5 from section 3.2.2.4 to validate domain ownership. Or, put in laymen\u2019s terms, CAs will no longer be allowed rely solely upon WHOIS look ups and legal opinion letters to validate ownership of a domain.<\/p>\n
There\u2019s a little bit to unpack here, so let\u2019s start from the top with a quick refresher on the CAB Forum before we get into the actual substance of the changes.<\/span><\/p>\n The Certificate Authority\/Browser Forum or CAB Forum serves as a de facto regulatory body for the digital certificate industry. Comprised Certificate Authorities and the major browsers, the Forum is responsible for determining the baseline requirements that govern certificate issuance.<\/p>\n The CAB Forum has been actively working to improve domain validation since around the Spring of 2015. As DigiCert\u2019s Tim Hollebeek puts it<\/a>:<\/p>\n Historically, the requirements around the mechanics of how [domain validation was] done were pretty vague and loose. Even worse, CAs were allowed to use \u201cany other method\u201d to validate control of the domain name, as long as they argued it was at least as secure as one of the listed methods. This left lots of room for CAs to cut corners on validation of certificates.<\/p><\/blockquote>\n So, on August 5, 2016, Ballot 169<\/a> was passed. It officially removed the \u201cany other methods\u201d portion of the baseline requirements. It was hoped that some of the new technical steps that were added at the time would be used by the CAs, thus ensuring stronger validation, but most CAs opted not to implement these new methods and instead continued using older methods.<\/p>\n In response, in December of 2017 the CAB Forum again set out to strengthen domain validation, this time by eliminating a pair of older validation methods that have been deemed unsafe.<\/p>\n