Topic starter
25/06/2026 2:45 pm
TL;DR: Ballot SC-090 would phase out legacy certificate validation methods that depend on email, phone, fax, or IP crossover checks and push the ecosystem toward fully automated domain and IP validation, according to DigiCert. Manual validation is becoming operational debt, and certificate lifecycle management now has to be built around automation rather than human intervention.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “CA/BF Ballot SC-090: A Step Closer to Fully Automated Validation”.
By the numbers:
- The reuse period for domain and IP address validation will continue to shorten over the next several years, ultimately landing at 10 days in 2029.
- Method 3.2.2.4.8 will be prohibited on or after March 15, 2026.
- The phone, fax and postal methods in Phase 2 will not be allowed on or after March 15, 2027.
Key questions
Q: What breaks when certificate validation still depends on manual contact methods?
A: Manual validation breaks at scale because it introduces human availability, routing delays and inconsistent control execution into a process that needs to be repeatable.
Q: Why do shorter validation reuse periods change certificate governance?
A: Shorter reuse periods force teams to prove domain control more frequently, which reduces the value of one-time approvals and stale validation state.
Q: How should security teams transition from email validation to automated validation?
A: They should inventory every workflow that uses email, phone, fax or crossover checks, then move those paths to DNS- or HTTP-based validation that certificate systems can run automatically.
Practitioner guidance
- Replace manual validation paths Map every certificate validation workflow that still depends on email, phone, fax or postal contact and queue it for retirement before the ballot dates take effect.
- Move validation into automated control paths Adopt DNS-based or HTTP-based validation where your certificate lifecycle platform can perform proof of control on demand without human intervention.
- Rework certificate ownership records Align domain ownership, certificate inventory and renewal responsibility so shorter validation reuse periods do not create hidden operational gaps.
Bottom line: SC-090 is a signal that certificate validation is being redefined as an automated control rather than a human-mediated approval process.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
25/06/2026 3:53 pm
SC-090 turns certificate validation into a lifecycle governance problem, not a point-in-time issuance step. The article shows that the industry is steadily removing validation paths that depend on people, paper and voice contact. That changes the governance question from whether a certificate was once approved to whether the validation process itself can be executed and repeated automatically.
A question worth separating out:
Q: What is the difference between certificate issuance validation and certificate renewal automation?
A: Issuance validation proves control before a certificate is issued, while renewal automation ensures that proof can be refreshed repeatedly as the certificate lifecycle continues. Teams need both, because a one-time check does not solve the operational burden of repeated validation under shorter reuse windows.
👉 Read our full editorial: Certificate validation is moving to full automation under SC-090
This post was modified 4 days ago by NHI Mgmt Group