SC-089: every CA needs a tested mass revocation plan

SC-089 makes CAs prepare for the day they have to revoke a large share of their certificates at once. Every publicly trusted TLS CA must keep a written mass revocation plan, test it every year, and since 2025-12-01 state in its CPS that it does so.

What changed

SC-089 added §5.7.1.2 to the Baseline Requirements. The text says mass revocation events have exposed weaknesses in CA readiness, communication with customers and timely replacement of revoked certificates. The plan must include objective activation thresholds, how customer contact details are kept current, which steps are automated, target timelines, how subscribers are notified, who does what, staff training, annual testing (tabletop exercises or simulations, without revoking real certificates) and how lessons learned are folded back in. CAs don't have to publish the plan itself. Mozilla's root program already required such a plan; the ballot was proposed by Mozilla and endorsed by D-Trust and OISTE.

Effective dates

The BR change took effect on 2025-08-25. The CPS assertion is required from 2025-12-01.

Who is affected

SC-089 affects CAs directly and site owners indirectly: when a CA discovers a mistake affecting many certificates, the BRs can require revocation within days, and a CA with a tested plan is more likely to give clear notice and a fast replacement path.

What to do

Be ready for an early replacement. Keep the contact email on your CA account current, automate renewal so a certificate can be replaced on short notice, and consider ACME clients that support ARI, which lets a CA ask clients to renew early. See automating certificate renewal.