Ballot SC0101v2: Clarify Authorization Domain Names

Result and scope

• Ballot SC0101v2 Clarify Authorization Domain Names was adopted by the Forum (Bylaw 2.3(6) and related quorum/participation requirements were MET).
• The ballot modifies Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, focusing on how CAs derive and validate Authorization Domain Names (ADNs).

Key changes described in the ballot

• In Section 3.2.2.4, the ballot explicitly describes the algorithm a CA may use to derive an Authorization Domain Name from an applied-for FQDN.
• The ballot simplifies the definition of Authorization Domain Name to be merely descriptive and updates validation methods to describe how they validate control of the selected ADN.
• The ballot collapses previous statements about validation method suitability for wildcard and ending-in-the-same-suffix validation into a table in Section 3.2.2.4.
• As knock-on effects, the ballot simplifies the definitions of Base Domain Name and Domain Contact.

Compliance timing described in the ballot

• The ballot includes a provision allowing CAs to comply with Section 3.2.2.4 of the previous version of the Baseline Requirements until November 15, 2026.

Security and rationale described in the ballot

• The ballot states the existing definition of Authorization Domain Name has ambiguity about whether parts of the definition can be performed exclusively, in sequence, repeatedly, or otherwise.
• The ballot states that under some interpretations, it allows issuance for names over which the applicant has not demonstrated control.
• The ballot resolves the issue by more strictly describing the acceptable ADN derivation algorithm, including ordering of CNAME and prune steps and constraints on which validation methods can use those steps.