Ballot SC027v3: Version 3 Onion Certificates

Ballot overview

• Ballot SC027v3, Version 3 Onion Certificates, was proposed by Wayne Thayer of Mozilla and endorsed by Roland Shoemaker of Let’s Encrypt and Dimitris Zacharopoulos of HARICA.
• The ballot proposed two Final Maintenance Guidelines.
• It modifies the Baseline Requirements and the EV Guidelines to allow certificates for Version 3 .onion domain names.

What changes were proposed

• In the Baseline Requirements, the ballot adds a new rule in section 3.2.2.4 so that:
  • FQDNs that do not contain onion as the rightmost label continue to be validated using the existing listed methods.
  • FQDNs that do contain onion as the rightmost label must be validated in accordance with Appendix C.
• The ballot adds Appendix C to the Baseline Requirements for issuance of certificates for .onion domain names.
• In the EV Guidelines, the ballot modifies Appendix F so that EV issuance for .onion names may comply with Appendix F or Appendix C of the Baseline Requirements.
• The ballot states that older version 2 onion addresses are still in use, so it does not remove the existing EV Guidelines requirements for onion names.

Appendix C requirements for .onion names

• The domain name must contain at least two labels, with onion as the right-most label.
• The label immediately before onion must be a valid Version 3 Onion Address as defined in the Tor Rendezvous Specification - Version 3.
• The CA must verify the Applicant’s control over the .onion domain name using at least one of the listed methods:
  • Agreed-Upon Change to Website, with the timelines in section 3.2.2.4 applying if that method is replaced by a newer version.
  • A certificate request signed using the .onion public key, if the request includes a CA-generated caSigningNonce and an Applicant-generated applicantSigningNonce with at least 64 bits of entropy.
• The Random Value used for the confirming response must remain valid for no more than 30 days from creation, unless the CPS specifies a shorter period.
• A wildcard character may be included as the left-most character in the .onion domain name in the Subject Alternative Name Extension and Subject Common Name Field, if Section 3.2.2.6 is followed.
• A certificate containing an FQDN with onion in the right-most label is not considered an Internal Name if it was issued in compliance with Appendix C.

Ballot process and result

• Discussion period: 25-January 2020 00:00 UTC to 12-February 2020 20:00 UTC.
• Vote period: 12-February 2020 20:00 UTC to 19-February 2020 20:00 UTC.
• The ballot page says the voting period has ended and the ballot has Passed.
• Voting by Certificate Issuers: 15 votes total including abstentions, with 9 Yes, 0 No, and 6 Abstain.
• Voting by Certificate Consumers: 4 votes total including abstentions, with 4 Yes, 0 No, and 0 Abstain.
• The page states that the bylaw requirements were met for both Certificate Issuers and Certificate Consumers.
• The page states quorum was met.