GoDaddy: DV certificates with organizationalUnit field in subject

This case concerns GoDaddy-issued DV certificates that assert the DV policy OID (2.23.140.1.2.1) but include an organizationalUnit value in the Subject field. The reporter cited Baseline Requirements 7.1.4.2.2(i) as restricting when the organizationalUnit field can appear and asked GoDaddy to provide an incident response. GoDaddy responded that it does not include names, DBAs, tradenames, trademarks, addresses, locations, or other text referring to a specific natural person or legal entity in the OU field for its DV certificates, and that the OU value used in the examples is “Domain Control Validated,” which GoDaddy stated does not refer to a specific natural person or legal entity. GoDaddy also stated it remains compliant with the Baseline Requirements and will continue to align with any amendments. The reporter then asked for a link/reference to where GoDaddy fulfills the Baseline Requirements requirements related to including an OU, pointing to GoDaddy/Starfield CP/CPS. GoDaddy provided CP/CPS references describing what Starfield verifies for certificate types and showing the OU field output (e.g., “Domain Control Verified”). Mozilla indicated the bug would be scheduled for closure on 12 October 2020, and the bug is marked RESOLVED with resolution FIXED.

1. 2020-09-02 Bug opened after concern that GoDaddy DV certificates include an organizationalUnit value in the Subject field.
2. 2020-09-04 GoDaddy replied that its OU value (“Domain Control Validated”) does not refer to a specific natural person or legal entity and asserted Baseline Requirements compliance.
3. 2020-09-04 Reporter requested a CP/CPS link/reference showing where GoDaddy fulfills OU-related requirements.
4. 2020-09-16 GoDaddy provided CP/CPS section references describing verification and OU field output.
5. 2020-10-06 Mozilla scheduled the bug for closure.

1. 2020-09-02 Community commenter — Reported that GoDaddy DV certificates include an organizationalUnit in the Subject field and asked for an Incident Response per the Baseline Requirements discussion.
2. 2020-09-04 GoDaddy — Explained that GoDaddy’s DV OU field uses “Domain Control Validated,” does not contain personal/legal-entity text, and stated GoDaddy remains compliant.
3. 2020-09-04 Community commenter — Disputed the interpretation and asked for a link/reference in GoDaddy’s CP/CPS showing how OU inclusion requirements are fulfilled.
4. 2020-09-16 GoDaddy — Provided CP/CPS references (Section 3.2 and Section 10.4) describing verification and showing OU output examples.
5. 2020-10-06 Mozilla representative — Indicated no further questions/comments and that the bug would be scheduled for closure on 12 October 2020.