# HTTPS certificate industry phasing out less secure domain validation methods

DevFeed: [HTTPS certificate industry phasing out less secure domain validation methods](<https://devfeed.tech/articles/https-certificate-industry-phasing-out-less-secure-domain-validation-methods-19810.md>)

Original publisher: [Read original article](<http://security.googleblog.com/2025/12/https-certificate-industry-phasing-out.html>)

Author: Google (noreply@blogger.com)

Published: 2025-12-10T20:00:00Z

Content type: article

Language: en

Sources: [Google Online Security](<https://devfeed.tech/sources/google-online-security.md>)

Topics: [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Security](<https://devfeed.tech/topics/security.md>), [Internet](<https://devfeed.tech/topics/internet.md>), [Website](<https://devfeed.tech/topics/website.md>)

Tags: [automation](<https://devfeed.tech/tags/automation.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [internet](<https://devfeed.tech/tags/internet.md>), [none](<https://devfeed.tech/tags/none.md>), [security](<https://devfeed.tech/tags/security.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

The Chrome Root Program and CA/Browser Forum are phasing out 11 legacy Domain Control Validation methods for HTTPS certificates. The change will be introduced gradually, with full implementation planned by March 2028, encouraging automated and cryptographically verifiable validation.

## Source excerpt

Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers. These initiatives, driven by Ballots SC-080, SC-090, and SC-091, will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security. To allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028. This effort is a key part of our public roadmap, "Moving Forward, Together," launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While "Moving Forward, Together" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards. What's Domain Control Validation? Domain Control Validation is a security-critical process designed to ensure certificates are only issued to the legitimate domain operator. This prevents unauthorized entities from obtaining a certificate for a domain they do not control. Without this check, an attacker could obtain a valid certificate for a legitimate website and use it to impersonate that site or intercept web traffic. Before issuing a certificate, a Certification Authority (CA) must verify that the requestor legitimately controls the domain. Most modern validation r