# SC-033: TLS-ALPN validation replaces the old method 10

> SC-033 replaced the loosely specified TLS validation method 3.2.2.4.10 with method 3.2.2.4.20 based on RFC 8737 (ACME tls-alpn-01) in 2020.

Source: https://ssl.sh/ballots/sc-033/
Last updated: 2026-11-10

SC-033 made the [TLS-ALPN-01](https://ssl.sh/glossary/tls-alpn-01/) ACME challenge a formal BR validation method. In 2020 it replaced the vaguely specified validation method 3.2.2.4.10 with a new method 3.2.2.4.20 that follows RFC 8737, where the CA connects to your server on port 443 and checks a special certificate offered under the `acme-tls/1` [ALPN](https://ssl.sh/glossary/alpn/) protocol.

## What changed

SC-033 removed method 10 and added method 20, "TLS Using ALPN". Method 10, "TLS Using a Random Number", was how the ACME TLS-SNI-01 challenge worked, and in January 2018 a vulnerability in that challenge was disclosed: on shared hosting, one customer could get a certificate for another customer's domain. Some browsers had banned method 10 unless mitigated, and the IETF standardized the ALPN-based fix as RFC 8737. The ballot also restricts the new method to the exact FQDN validated: other subdomains require a new validation and wildcards are not permitted, because the ballot considers DNS-based methods more appropriate for whole subdomains. Mozilla proposed it; Let's Encrypt and DigiCert endorsed it.

## Effective dates

The BR change took effect on 2020-09-22, with no transition period for method 10.

## Who is affected

Users of ACME clients that support tls-alpn-01, such as servers and proxies that answer the challenge themselves on port 443. HTTP-01 and DNS-01 users are not affected.

## What to do

Use tls-alpn-01 when port 80 is closed but 443 is reachable and your software supports it. For wildcards use [DNS-01](https://ssl.sh/glossary/dns-01/). Background: [how ACME works](https://ssl.sh/learn/acme-protocol/).


| Field | Value |
|---|---|
| Ballot | SC-033 |
| Status | Passed |
| Adopted | 2020-08-14 |
| Effective | 2020-09-22 |
| BR version | 1.7.2 |
| Official page | https://cabforum.org/2020/08/14/ballot-sc033-tls-using-alpn-method/ |