Voting Period Begins: Ballot SC-102: EV Domain Reuse and Validity Alignment

[Dustin Hollenback]

Ballot SC-102: EV Domain Reuse and Validity Alignment

Summary of the Ballot

This ballot aligns Extended Validation domain re-validation and certificate validity with the Baseline Requirements, removing EV-specific values that the Baseline Requirements already supersede. It makes the following changes to the EV Guidelines:

• Removes the WHOIS/RDAP same-registrant re-check from the domain reuse path in Section 3.2.2.14.1(6), so EV domain re-validation relies on Section 3.2.2.7 like any other domain validation.
• Replaces the hardcoded "398 days" Domain Name data reuse period in Section 3.2.2.14.3(1) with a reference to Section 4.2.1 of the Baseline Requirements, and generalizes the related "398-day period" sentence.
• Replaces the EV certificate validity text in Section 6.3.2 with a reference to Section 6.3.2 of the Baseline Requirements.

These changes are not expected to be disruptive. An EV Certificate is already a TLS Subscriber Certificate bound by the Baseline Requirements, so the ballot removes redundant or stale text rather than imposing new obligations. There is not a future effective date as there is not an expected new requirement.

Background of the Ballot

The Baseline Requirements have moved away from relying on WHOIS/RDAP registration data for domain validation (SC-080 sunset the WHOIS/RDAP-dependent Domain Contact methods) and they now carry a published schedule (SC-081) that reduces both certificate validity and data reuse periods over time. The EV Guidelines, however, still hardcode "398 days" for both the Domain Name data reuse period and EV certificate validity. Those figures are already incorrect: the Baseline Requirements cap Domain Name reuse at 200 days today and decline further on the published schedule, and they cap validity on the same trajectory. Because an EV Certificate is a TLS Subscriber Certificate, it is already bound by those limits, so the separate EV-specific values are at best redundant and at worst misleading. The same-registrant re-check in Section 3.2.2.14.1(6) depends on that same WHOIS/RDAP registration data which the Forum has been moving away from for validation and it is redundant with the domain control re-verification already required under Section 3.2.2.7. This ballot removes these EV-specific provisions so EV domain re-validation and validity track the Baseline Requirements directly.

This ballot is proposed by Dustin Hollenback (Apple) and endorsed by Martijn Katerbarg (Sectigo) and Scott Rea (eMudhra).

--- Motion Begins ---

Modify the "Guidelines for the Issuance and Management of Extended Validation Certificates", based on Version 2.0.2, per the following redline:

https://github.com/cabforum/servercert/compare/cabforum:1bcb34993331313c92ac7d6af778e81ca3d5faff...dustinhollenback-apple:28777f520309c2ae5561b81e223b34cc9aed93ef

--- Motion Ends ---

This ballot proposes a Final Maintenance Guideline and will be subject to a 30-day IPR Review Period following a successful vote.

Discussion Period (at least 7 calendar days):

• Start time: Thursday, 2026-06-18 16:00 UTC
• End time: Tuesday, 2026-07-07 05:00 UTC

Vote for approval (exactly 7 calendar days): 

• Start time: Tuesday, 2026-07-07 05:30 UTC
• End time: Tuesday, 2026-07-14 05:30 UTC

[Dustin Hollenback]

Apple votes “Yes” on SC-102.

--
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/F8DFD13B-C980-4A6B-9C78-245EC4E61953%40apple.com.

[Pedro FUENTES]

OISTE votes yes to SC-102

Le 7 juil. 2026 à 07:34, 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org> a écrit :

Apple votes “Yes” on SC-102.

To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/BF8F9C94-0D9F-4345-96A3-CB7F61B7542C%40apple.com.

[Michael Guenther]

SwissSign votes 'yes' on SC-102

 

Mike

--

[Dimitris Zacharopoulos (HARICA)]

HARICA votes "yes" to ballot SC102.

[Ben Wilson]

Mozilla votes "Yes" on Ballot SC-102.

--

[Scott Rea]

eMudhra votes YES on Ballot SC-102

Disclaimer: The email and its contents hold confidential information and are intended for the person or entity to which it is addressed. If you are not the intended recipient, please note that any distribution or copying of this email is strictly prohibited as per Company Policy, you are requested to notify the sender and delete the email and associated attachments with it from your system.

[Martijn Katerbarg]

Sectigo votes YES on Ballot SC-102

From: 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>
Date: Tuesday, 7 July 2026 at 07:32
To: server...@groups.cabforum.org <server...@groups.cabforum.org>

[黃晟(orca)]

TWCA votes Yes on Ballot SC-102.

 

Best,

 

Sean Huang

Senior PKI Compliance Engineer
TEL：02-2370-8886#728
FAX：02-2388-6720
Email：or...@twca.com.tw

10F., No. 85, Yanping South Road,

Taipei, Taiwan (R.O.C.)

--

[Christophe Bonjean]

GlobalSign votes “Yes” on Ballot SC-102.

 

Christophe

 

From: 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: 07 July 2026 07:31
To: server...@groups.cabforum.org

--

[Michael Stone]

CFCA votes “YES” on Ballot SC-102.

Michael

CFCA

[Nome Huang]

TrustAsia votes "Yes" on Ballot SC-102.

[Alvin Wang]

SHECA votes “Yes” on SC-102.

Alvin.Wang

On Tuesday, July 7, 2026 at 1:32:03 PM UTC+8 dholl...@apple.com wrote:

[jun....@cybertrust.co.jp]

Cybertrust Japan votes Yes on Ballot SC-102

-----Original Message-----
From: 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>
Sent: Tuesday, July 7, 2026 2:31 PM
To: server...@groups.cabforum.org

Subject: [Servercert-wg] Voting Period Begins: Ballot SC-102: EV Domain Reuse and Validity Alignment

Ballot SC-102: EV Domain Reuse and Validity Alignment

Summary of the Ballot
This ballot aligns Extended Validation domain re-validation and certificate validity with the Baseline Requirements, removing EV-specific values that the Baseline Requirements already supersede. It makes the following changes to the EV Guidelines:

* Removes the WHOIS/RDAP same-registrant re-check from the domain reuse path in Section 3.2.2.14.1(6), so EV domain re-validation relies on Section 3.2.2.7 like any other domain validation.
* Replaces the hardcoded "398 days" Domain Name data reuse period in Section 3.2.2.14.3(1) with a reference to Section 4.2.1 of the Baseline Requirements, and generalizes the related "398-day period" sentence.
* Replaces the EV certificate validity text in Section 6.3.2 with a reference to Section 6.3.2 of the Baseline Requirements.

These changes are not expected to be disruptive. An EV Certificate is already a TLS Subscriber Certificate bound by the Baseline Requirements, so the ballot removes redundant or stale text rather than imposing new obligations. There is not a future effective date as there is not an expected new requirement.


Background of the Ballot
The Baseline Requirements have moved away from relying on WHOIS/RDAP registration data for domain validation (SC-080 sunset the WHOIS/RDAP-dependent Domain Contact methods) and they now carry a published schedule (SC-081) that reduces both certificate validity and data reuse periods over time. The EV Guidelines, however, still hardcode "398 days" for both the Domain Name data reuse period and EV certificate validity. Those figures are already incorrect: the Baseline Requirements cap Domain Name reuse at 200 days today and decline further on the published schedule, and they cap validity on the same trajectory. Because an EV Certificate is a TLS Subscriber Certificate, it is already bound by those limits, so the separate EV-specific values are at best redundant and at worst misleading. The same-registrant re-check in Section 3.2.2.14.1(6) depends on that same WHOIS/RDAP registration data which the Forum has been moving away from for validation and it is redundant with the domain control re-verification already required under Section 3.2.2.7. This ballot removes these EV-specific provisions so EV domain re-validation and validity track the Baseline Requirements directly.

This ballot is proposed by Dustin Hollenback (Apple) and endorsed by Martijn Katerbarg (Sectigo) and Scott Rea (eMudhra).


--- Motion Begins ---

Modify the "Guidelines for the Issuance and Management of Extended Validation Certificates", based on Version 2.0.2, per the following redline:

https://github.com/cabforum/servercert/compare/cabforum:1bcb34993331313c92ac7d6af778e81ca3d5faff...dustinhollenback-apple:28777f520309c2ae5561b81e223b34cc9aed93ef

--- Motion Ends ---


This ballot proposes a Final Maintenance Guideline and will be subject to a 30-day IPR Review Period following a successful vote.



Discussion Period (at least 7 calendar days):

* Start time: Thursday, 2026-06-18 16:00 UTC
* End time: Tuesday, 2026-07-07 05:00 UTC

Vote for approval (exactly 7 calendar days):

* Start time: Tuesday, 2026-07-07 05:30 UTC
* End time: Tuesday, 2026-07-14 05:30 UTC

--
You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org <mailto:servercert-w...@groups.cabforum.org> .
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/F8DFD13B-C980-4A6B-9C78-245EC4E61953%40apple.com <https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/F8DFD13B-C980-4A6B-9C78-245EC4E61953%40apple.com?utm_medium=email&utm_source=footer> .

[Chad Dandar (cdandar)]

Cisco votes “Yes” on Ballot SC-102.

 

Chad Dandar

Cisco

 

From: 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Monday, July 6, 2026 10:31 PM
To: server...@groups.cabforum.org

--

You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.

To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/F8DFD13B-C980-4A6B-9C78-245EC4E61953%40apple.com.

[Andrea Holland]

IdentTrust votes Yes on SC-102

 

Andrea Holland

 

From: 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Tuesday, July 7, 2026 1:31 AM
To: server...@groups.cabforum.org

--

[郭宗閔]

Chunghwa Telecom votes “Yes” on Ballot SC-102.

 

Best regards,

Chunghwa Telecom Co., Ltd., Taiwan (R.O.C.)

Tsung-Min Kuo

 

--

You received this message because you are subscribed to the Google Groups "Server Certificate WG (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to servercert-w...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/servercert-wg/F8DFD13B-C980-4A6B-9C78-245EC4E61953%40apple.com.

本信件可能包含中華電信股份有限公司機密資訊,非指定之收件者,請勿蒐集、處理或利用本信件內容,並請銷毀此信件. 如為指定收件者,應確實保護郵件中本公司之營業機密及個人資料,不得任意傳佈或揭露,並應自行確認本郵件之附檔與超連結之安全性,以共同善盡資訊安全與個資保護責任.
Please be advised that this email message (including any attachments) contains confidential information and may be legally privileged. If you are not the intended recipient, please destroy this message and all attachments from your system and do not further collect, process, or use them. Chunghwa Telecom and all its subsidiaries and associated companies shall not be liable for the improper or incomplete transmission of the information contained in this email nor for any delay in its receipt or damage to your system. If you are the intended recipient, please protect the confidential and/or personal information contained in this email with due care. Any unauthorized use, disclosure or distribution of this message in whole or in part is strictly prohibited. Also, please self-inspect attachments and hyperlinks contained in this email to ensure the information security and to protect personal information.

[大野 文彰]

SECOM Trust Systems votes YES on Ballot SC-102.

 

Best regards,

 

ONO Fumiaki / 大野 文彰

(Japanese name order; family name in uppercase)

SECOM Trust Systems CO., LTD.

 

From: 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Tuesday, July 7, 2026 2:31 PM
To: server...@groups.cabforum.org

--

[Yoshihiko Matsuo]

JPRS votes YES on Ballot SC-102.

Yoshihiko Matsuo(JPRS)

[Kateryna Aleksieieva]

Certum votes YES on Ballot SC-102

 

Kind regards,

Kateryna Aleksieieva

From: 'Dustin Hollenback' via Server Certificate WG (CA/B Forum) <server...@groups.cabforum.org>

Sent: Tuesday, July 7, 2026 7:31 AM
To: server...@groups.cabforum.org

--