Open. Collaborative. Compliant.

What is domain control validation?

Domain control validation (also known as domain validation) is a process used by public certificate authorities (CAs) to verify that the individual or organization requesting a TLS/SSL certificate has control over the domain for which the certificate is being issued. This is a fundamental and critical step in the process of issuing TLS/SSL certificates and ensures that only individuals or entities with legitimate control over a domain are issued a certificate for that domain.

The CA/Browser Forum has specified the CA/B Forum Baseline Requirements to validate that an applicant has ownership or control over a domain. These requirements specify a range of approaches to perform this validation using a variety of technologies including email, DNS record verification, and HTTP/HTTPS verification.

The importance of rigorous domain validation

Domain validation is a fundamental process of verifying the legitimate owner of a domain. Flaws in the validation process can lead to the mis-issuance of certificates to malicious actors who can take advantage of this vulnerability to perform fraud, phishing, and malware campaigns.

Providing these libraries to the community for a thorough evaluation and ongoing improvement will ensure that all certificate authorities maintain a high level of quality on the domain validation process.

What sets pkilint apart?

DigiCert’s pkilint framework can be adapted to any certificate type to test against the specifications outlined in standards that apply to digital certificate formats.

pkilint was developed based on DigiCert’s experience using certificate linters in high-volume environments. The pkilint framework provides several advantages over existing approaches:

• Built on top of a proven ASN.1 parser, allowing very detailed checks that detect ASN.1 encoding errors.
• Architected from the ground up to support linting of many different types of PKI structures (including certificates, CRLs, and OCSP responses) against different standards and trust frameworks.
• Rich validation logic analyzes every field of an ASN.1 document and determines which sets of tests to execute. This results in faster and more thorough testing, with less development time.

In addition to pkilint, DigiCert recently provided an OSS tool called SMBR-Cert-Factory allowing users to generate test certificates that are compliant with the different certificate profiles defined in S/MIME Baseline Requirements.

Related resources