The HTTPS certificate industry is moving to gradually phase out 11 outdated methods for verifying control of a domain, following the adoption of new security requirements by Chrome’s Root Program and the CA/Browser Forum. The methods being retired rely on weaker signals, such as regular mail, phone calls, and email messages, while the new rules encourage the use of automated alternatives that can be cryptographically verified.
According to the Chrome Root Program team, the phase-out will be implemented in stages to give affected website operators time to transition. The full security value of this step is expected to be realized by March 2028. The initiative is linked to the broader “Moving Forward Together” roadmap launched in 2022, while the latest updates to the Baseline Requirements for TLS turn this direction into industry policy.
What Does Domain-Control Verification Mean?
Verifying control of a domain is a fundamental step before issuing a certificate, as the certificate authority (CA) must ensure that the applicant actually controls the domain to be protected. This prevents unauthorized parties from obtaining a valid certificate for a website they do not own, which could enable website impersonation or traffic interception.
Modern methods often rely on a “challenge-and-response” mechanism. Instead of relying solely on indirect contact information, the certificate authority may provide the applicant with a random value to place at a specific location, such as a DNS TXT record, and then verify that it exists. Older methods, by contrast, used contact information extracted from WHOIS records or sent messages to addresses associated with the domain, approaches that have proven vulnerable.
Methods Being Phased Out
The email-based methods include:
- Email, fax, text message, or regular mail to the domain contact.
- Email, fax, text message, or regular mail to the IP address contact.
- Constructed email to the domain contact.
- Email to the DNS CAA contact.
- Email to the DNS TXT contact.
The phone-based methods include:
- Telephone contact with the domain contact.
- Telephone contact with the DNS TXT record contact.
- Telephone contact.
- Telephone contact with the DNS CAA contact.
- Telephone contact with the IP address contact.
One method based on reverse address lookup will also be discontinued: reverse lookup of an IP address.
Impact of the Change on Websites and Users
Ordinary users will not notice these changes directly, which is intentional according to the Chrome Root Program team. However, eliminating outdated or indirect signals will make it more difficult for attackers to trick certificate authorities into issuing certificates for domains they do not control.
The new rules aim to reduce the risks associated with misuse of outdated WHOIS data, complex email and telephone environments, and legacy infrastructure. They also encourage website owners to adopt modern, standardized, and auditable methods such as ACME, enabling certificate lifecycle management to be handled more quickly and efficiently through automation. The Root Program team believes these steps remove weak links from the mechanism used to establish trust on the internet, thereby improving browsing safety for users of different browsers, platforms, and websites.