Ballot SC082: Clarify CA Assisted DNS Validation under 3.2.2.4.7

Ballot outcome

• Ballot SC082: Clarify CA Assisted DNS Validation under 3.2.2.4.7
• Voting results: FAILED

Purpose and scope

• Clarifies the practice of CA Assisted DNS Validation.
• Adds constraints under Method 7 (3.2.4.4.7 DNS Change).
• States that modification of other domain validation methods and introduction of new domain validation methods are not in scope.

Key proposed changes (as described in the ballot page and redline)

• Adds a new definition: Canonical Authorization Domain Name.
• Adds Canonical Authorization Domain Names into section 3.2.2.4.7 (DNS Change).
• Adds constraints around CA usage of Canonical Authorization Names, including:
  • Enforce that CNAMEs are unique to an Applicant and not shared with multiple Applicants.
  • Expire DNS lookup results after 8 hours.
  • Restrict the type of DNS records located in zones used for this purpose.

Voting and bylaws requirements (as reported on the ballot page)

• Bylaw 2.3(6):
  • Certificate Issuer category: two-thirds (2/3) or more requirement was MET.
  • Certificate Consumer category: 50% plus one (1) requirement was NOT MET.
  • At least one (1) Voting Member in each category voting in favour: NOT MET.
• Bylaw 2.3(7): quorum requirement was MET.

Motion and artifacts referenced

• Motion begins and ends are listed on the ballot page.
• GitHub pull request and a GitHub compare link are provided as the redline basis for the proposed changes.