[Servercert-wg] Ballot SC12 - Sunset of Underscores in DNSNames
wthayer at mozilla.com
Fri Oct 26 11:59:56 MST 2018
This begins the review period for Ballot SC12 - Sunset of Underscores in
Purpose of Ballot
Ballot 202 included a provision creating a permanent exception permitting
the underscore character to be used in SAN fields of type DNSName. Since
that ballot failed in 2017, the practice has continued despite being
non-compliant with RFC 5280. This ballot creates a brief sunset period
intended to allow Subscribers who are relying on FQDNs containing
underscores to transition away from them, either by changing the name or
deploying a wildcard certificate.
The following motion has been proposed by Wayne Thayer of Mozilla and
endorsed by Dave Blunt of Amazon and Tim Shirley of Trustwave.
--- MOTION BEGINS ---
Add the following language to BR section 184.108.40.206.1 (Subject Alternative
Prior to April 1, 2019, certificates containing underscore characters (“_”)
in domain labels in DNSName entries MAY be issued as follows:
* DNSName entries MAY include underscore characters such that replacing all
underscore characters with hyphen characters (“-“) would result in a valid
domain label, and;
* Underscore characters MUST NOT be placed in the left most domain label,
* Such certificates MUST NOT be valid for longer than 30 days.
All certificates containing an underscore character in any DNSName entry
and having a validity period of more than 30 days MUST be revoked prior to
January 15, 2019.
After April 30, 2019, underscore characters (“_”) MUST NOT be present in
--- MOTION ENDS ---
This ballot proposes a Final Maintenance Guideline. A comparison of the
changes can be found at:
The procedure for approval of this ballot is as follows:
Discussion (7-21 days)
Start Time: 2018-10-26, 19:00 UTC
End Time: Not before 2018-11-02, 19:00 UTC
Vote for approval (7 days)
Start Time: 2018-11-xx, 19:00 UTC
End Time: 2018-11-xx, 19:00 UTC
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Servercert-wg