SC-042: domain validation can be reused for 398 days, not 825

SC-042 shortened how long a completed domain validation stays usable. For certificates issued from 2021-10-01, a CA may only rely on domain name or IP address validation that is at most 398 days old; before that it could reuse validation data for up to 825 days.

What changed

SC-042 added one sentence to §4.2.1 of the Baseline Requirements: effective 2021-10-01, for validation of domain names and IP addresses under §3.2.2.4 and §3.2.2.5, any reused data, document or completed validation must be obtained no more than 398 days before issuing the certificate. In the EV Guidelines it replaced eight mentions of "thirteen months" with 398 days. It deliberately left the 825-day reuse period for organization information untouched. Mozilla proposed it; HARICA and Firmaprofesional endorsed it.

Effective dates

The BR change took effect on 2021-06-02; the 398-day reuse limit applied to certificates issued from 2021-10-01.

Who is affected

Mainly customers who bought multi-year certificate subscriptions and expected a single domain validation to cover several reissues. After this ballot the domain had to be re-validated roughly once a year. ACME clients validate on every order, so they weren't affected. The rule aligned validation reuse with the 398-day certificate lifetime set by SC-031 in 2020.

What to do

Automate validation, for example with DNS-01, rather than relying on old validations. The 398-day limit is history: SC-081v3 lowered reuse to 200 days in 2026, 100 days in 2027 and 10 days in 2029.