KEVWire

Security intelligence, with context.

Response snapshot Oct 27, 2026, 06:26 UTC

Back to the wire
Permalink
Advisorygoogle-security-https-certificate-industry-phasing-out-c06fe74ff2a8

HTTPS certificate industry phasing out less secure domain validation methods

Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it.

Published Updated

At a glance

Sources
1 source

What to do

Read the exact official research article before applying its defensive techniques or drawing conclusions.

Read Google Security Research: HTTPS certificate industry phasing out less secure domain validation methods (opens a new tab)

What happened

Posted by Chrome Root Program Team

Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.

These initiatives, driven by Ballots SC-080 , SC-090 , and SC-091 , will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security.

To allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028.

Continue reading

This effort is a key part of our public roadmap, “ Moving Forward, Together, ” launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While "Moving Forward, Together" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy.

This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards.

What’s Domain Control Validation?

Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic.

Before issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most modern validation relies on “challenge-response” mechanisms, for example, a CA might provide a random value for the requestor to place in a specific location, like a DNS TXT record, which the CA then verifies.

Historically, other methods validated control through indirect means, such as looking up contact information in WHOIS records or sending an email to a domain contact. These methods have been proven vulnerable ( example ) and the recent efforts retire these weaker checks in favor of robust, automated alternatives.

Raising the floor of security

The recently passed CA/Browser Forum Server Certificate Working Group Ballots introduce a phased sunset of the following Domain Control Validation methods. Alternative existing methods offer stronger security assurances against attackers trying to obtain fraudulent certificates – and the alternative methods are getting stronger over time, too.

Sunsetted methods relying on email:

Email, Fax, SMS, or Postal Mail to Domain Contact

Email, Fax, SMS, or Postal Mail to IP Address Contact

Constructed Email to Domain Contact

Email to DNS CAA Contact

Email to DNS TXT Contact

Sunsetted methods relying on phone:

Phone Contact with Domain Contact

Phone Contact with DNS TXT Record Phone Contact

Phone Contact with DNS CAA Phone Contact

Phone Contact with IP Address Contact

Sunsetted method relying on a reverse lookup:

IP Address

Reverse Address Lookup

For everyday users, these changes are invisible - and that’s the point. But, behind the scenes, they make it harder for attackers to trick a CA into issuing a certificate for a domain they don’t control. This reduces the risk that stale or indirect signals, (like outdated WHOIS data, complex phone and email ecosystems, or inherited infrastructure) can be abused.

These changes push the ecosystem toward standardized (e.g., ACME ), modern, and auditable Domain Control Validation methods. They increase agility and resilience by encouraging site owners to transition to modern Domain Control Validation methods, creating opportunities for faster and more efficient certificate lifecycle management through automation .

These initiatives remove weak links in how trust is established on the internet. That leads to a safer browsing experience for everyone , not just users of a single browser, platform, or website.

Sources

  1. Primary source

    Google Security Research: HTTPS certificate industry phasing out less secure domain validation methods (opens a new tab)

    Exact official article/advisory identified by the feed; title, source dates, and any supplied article excerpt.

    Published Checked

  2. Primary source

    Google Security Research syndication feed (opens a new tab)

    The RSS/Atom/RDF entry supplied this exact link and any available title, date, and excerpt.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2025, December 10). HTTPS certificate industry phasing out less secure domain validation methods. https://kevwire.com/record/google-security-https-certificate-industry-phasing-out-c06fe74ff2a8

MLA

"HTTPS certificate industry phasing out less secure domain validation methods." KEVWire, 10 Dec. 2025, kevwire.com/record/google-security-https-certificate-industry-phasing-out-c06fe74ff2a8.

Chicago

KEVWire. "HTTPS certificate industry phasing out less secure domain validation methods." Last modified December 10, 2025. https://kevwire.com/record/google-security-https-certificate-industry-phasing-out-c06fe74ff2a8.

Evidence summary (plain text)

HTTPS certificate industry phasing out less secure domain validation methods (Dec 10, 2025).
Posted by Chrome Root Program Team 

Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.

These initiatives, driven by Ballots SC-080 , SC-090 , and SC-091 , will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security.

To allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028.

This effort is a key part of our public roadmap, “ Moving Forward, Together, ” launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While "Moving Forward, Together" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards.

 What’s Domain Control Validation? 

Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic.

Before issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most mode
Sources:
Google Security Research: HTTPS certificate industry phasing out less secure domain validation methods: https://security.googleblog.com/2025/12/https-certificate-industry-phasing-out.html
Google Security Research syndication feed: https://security.googleblog.com/feeds/posts/default?alt=rss&redirect=false&max-results=50
Record ID: google-security-https-certificate-industry-phasing-out-c06fe74ff2a8.
Record origin: Ingested record.
AI evidence: Not assessed.
About this data

This record was ingested from a data source. Retrieved: Oct 27, 2026, 05:35 UTC. Ingestion is not an independent editorial investigation.

This is an excerpt of official research, not a reproduced result or evidence of exposure to a scored vulnerability.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail