Ballot SC054: Onion Cleanup

Ballot overview

• Ballot SC054, Onion Cleanup, updated the Baseline Requirements and EV Guidelines to use the defined term Onion Domain Name.
• The ballot also removed the old Appendix F content from the EV Guidelines and replaced it with an intentionally left blank appendix.
• The ballot was proposed as a Final Maintenance Guideline.

Main content changes

• Added a defined term for Onion Domain Name in the Baseline Requirements.
• Reworded domain validation language so that non-Onion Domain Names are validated under the normal domain validation methods, while Onion Domain Names are validated under Appendix B.
• Updated CAA processing language so it applies to dNSName entries that do not contain an Onion Domain Name.
• Revised Appendix B to describe issuance of certificates for Onion Domain Names.
• In Appendix B, the CA may verify control over the .onion service using specified domain validation methods, or by using a certificate request signed using the .onion service's private key with caSigningNonce and applicantSigningNonce attributes.
• Updated EV Guidelines language so wildcard domain names are not allowed unless the FQDN portion is an Onion Domain Name verified under Appendix B.
• Replaced Appendix F in the EV Guidelines with an intentionally left blank appendix.

Voting and adoption

• Certificate Issuers: 18 yes votes, 0 no votes, 0 abstentions.
• Certificate Consumers: 6 yes votes, 0 no votes, 0 abstentions.
• The bylaw requirements were met for Certificate Issuers and Certificate Consumers.
• The quorum requirement was met.
• No IP Rights issues were raised during the review period.
• The ballot was adopted into version 1.8.4 of the Baseline Requirements for TLS Certificates and version 1.7.9 of the EV Guidelines for TLS Certificates.