The reuse period changes from 13 months to 397 days, which is just over 13 months. EV domain validation is mostly unaffected because domains on EV certificates already require revalidation every 13 months.Mozilla Root Store Policy 2.7.1 incudes Mozilla’s updated domain validation reuse policy.CA/B Forum Ballot SC42: 398-day Re-use Period.This will require customers who manage pre-validated domains to revalidate their domains roughly every 13 months.ĭigiCert will implement the changes between September 27 and 30, 2021 DigiCert will implement a 397 day reuse period to ensure absolute compliance. Mozilla and the CA/B Forum are reducing the domain validation reuse period to 398 days. In the meantime, review the current Domain Control Validation (DCV) Methods to see what other domain validation options you have. Make process and/or system changes to validate every SAN/FQDN individually (including the “free Alternately, change to DNS or Email validation methods to validate base domains () or an entire domain space.Īdditionally, to help you minimize certificate lifecycle disruption and maintain your business processes, we are working on future notifications, enhancements and training materials.We recommend the Email to DNS TXT Contact DCV method for those who prefer a static value and e-mail based domain validation. Change your domain validation method for wildcard certificates/domains if you use file-based validation.We will notify you as the date approaches with an action plan. Review your pre-validated domains before September 27, 2021.Įxisting domain validation expiration dates will be adjusted between September 27 and 30, 2021.Perform domain validation more frequently.ĭomain validation will expire every 397 days and disrupt certificate requests, renewals, and reissues if the domains are not revalidated.These policy changes affect all public TLS/SSL certificates.File-based domain validation, also known as file auth, http token, or http auth, will be disallowed for wildcard certificates, and when used for non-wildcard certificates, domain validation will be required for every individual SAN/fully qualified domain name (FQDN).ĭigiCert will implement the changes on November 16, 2021.Domain revalidation will be required every 397 days.ĭigiCert will implement the changes between September 27 and 30, 2021.These changes won’t affect TLS/SSL certificates already issued. These policy changes apply to all new certificate requests, renewals, reissues and pre-validated domains.

Two domain validation policy changes are expected to take effect before the end of 2021 that may affect how you validate your domains for certificate requests.

Domainer forums