Ballot SC-086v3: Sunset the Inclusion of IP Reverse Address Domain Names

Ballot overview

• Ballot SC-086v3 establishes a sunset on the practice of issuing publicly trusted TLS certificates containing hostnames under in-addr.arpa and ip6.arpa.
• The ballot proposes a Final Maintenance Guideline modifying the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (TLS Baseline Requirements) based on Version 2.1.7.

Motion and scope

• The motion is to modify the TLS Baseline Requirements based on Version 2.1.7 as specified in the provided redline comparison link.

Voting outcome (Bylaws Requirements)

• Certificate Issuer category: two-thirds (2/3) or more of votes cast in favor; requirement MET.
• Certificate Consumer category: at least fifty percent (50%) plus one (1) of votes cast in favor; requirement MET.
• At least one (1) Voting Member in each category voted in favor; requirement MET.
• Quorum requirement: quorum was 16 for this ballot; requirement MET.

Effective prohibition described in the ballot artifacts

• Effective 2026-03-15, CAs SHALL NOT issue Certificates containing Domain Names that end in an IP Reverse Zone Suffix.
• The ballot artifacts also state that CAs SHALL NOT issue Certificates containing Domain Names that end in an IP Reverse Zone Suffix (in the modified Baseline Requirements text and in the GeneralName dNSName entry description).