SC-086v3: no certificates for in-addr.arpa and ip6.arpa

SC-086v3 bans certificates for reverse-DNS names: since 2026-03-15, publicly trusted CAs may not issue TLS certificates for names such as 10.113.0.203.in-addr.arpa or anything under ip6.arpa, the reverse-DNS zones that map IP addresses back to names.

What changed

SC-086v3 added a rule to §4.2.2 of the Baseline Requirements: CAs shall not issue certificates containing domain names that end in an "IP Reverse Zone Suffix". The ballot text explains that in-addr.arpa and ip6.arpa are part of the Internet's infrastructure and are not intended to hold hostnames, so certificates for them are undesirable. It was proposed by DigiCert and endorsed by Apple and Opera.

Effective dates

The BR change became effective on 2025-12-15; the issuance ban applies from 2026-03-15.

Who is affected

SC-086v3 affects very few site operators: mainly anyone who used reverse-DNS names as Subject Alternative Names, for example in some network-device or mail setups. Certificates for IP addresses themselves (with IP address SANs) are a separate matter and are still allowed under the IP validation methods of §3.2.2.5.

What to do

Search your inventory for certificates whose SANs end in .in-addr.arpa or .ip6.arpa and replace them with certificates for a normal hostname or an IP address SAN before they expire; renewals with those names will be refused.