I've just seen this article regarding the phasing out of intranet names on SSL certificates.

However, CAs such as this one claim to still issue them and it will be "Trusted by all popular browsers" even though they are listed as members in the guidelines document.

There is also a guidance document available regarding internal server names.

My question is how are they still managing to issue SSL certificates for internal names if this is against CA/Browser Forum guidelines?

My only guess is that it depends on region - e.g. not possible in the US, but possible with a UK CA. If so could a US resident company/individual simply use a UK site to buy their certificate?


The CA/Browser Forum is a voluntary organization of Certification Authorities and suppliers of Internet browser and other relying-party software applications.

So it says on the second page of the "guidelines" document. The important word is "voluntary". These "guidelines" are not the Law. This just is a document edited by a group of corporations who found it worth the effort, at some point, to edit such a document, for unspecified reason.

These guidelines might be the basis for some contractual agreement between corporations; e.g. Microsoft might edict that commercial CA who wish to see their root CA public key included by default in the Windows "trusted store" must comply with the CA/Browser forum guidelines. However, not complying with the guidelines will not incur any legal retaliation beyond civil retorts about such contracts. This is a completely private business; the Law and the governments around the world have no relation whatsoever with these guidelines and their enforcement.

As a side note, it is known that though Microsoft tries to maintain some strict behaviour rules for the CA they set as "trusted by default", they must make exceptions for some "governmental CA" because refusing to include the pet CA key of some governments may imply the loss of access to big local markets. Regardless of what they may claim in the CA/Browser forum meetings, big players like Microsoft must already deal with "exceptions".

The interesting question, though, is what Comodo says to its co-members of the CA/Browser forum, since PositiveSSL is owned by Comodo. The ban on "intranet names" is supposed to be effective on November 1st, 2015 (no more certificates issued beyond that date), and enforced on October 1st, 2016 (still valid certificates with "intranet names" are revoked). My guess is that Comodo will try to make money for as long as possible, and may try to negotiate a longer phasing-out delay.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.