相關日期

Relevant Dates

Compliance	Section(s)	Summary Description (See Full Text for Details)
2025-01-15	4.9.9	Subscriber Certificate OCSP responses MUST be available 15 minutes after issuance.
2025-01-15	3.2.2.4	CAs MUST NOT rely on HTTPS websites to identify Domain Contact information. CAs MUST rely on IANA resources for identifying Domain Contact information.
2025-03-15	4.3.1.2	The CA SHALL implement a Linting process to test the technical conformity of the to-be-issued Certificate with these Requirements.
2025-03-15	8.7	The CA SHOULD use a Linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits.
2025-03-15	3.2.2.9	CAs MUST corroborate the results of domain validation and CAA checks from multiple Network Perspectives where specified.
2025-07-15	3.2.2.4	CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates.
2025-12-01	5.7.1.2	CAs SHALL assert in section 5.7.1 of their CPS or combined CP/CPS their mass revocation plan, testing, and continuous improvements.
2026-03-15	3.2.2.4	DNSSEC validation MUST be performed on all DNS queries associated with the validation of domain authorization or control by the Primary Network Perspective.
2026-03-15	3.2.2.4	CAs MUST NOT use local policy to disable DNSSEC validation on any DNS query associated with the validation of domain authorization or control.
2026-03-15	3.2.2.4	CAs MUST NOT rely on Method 3.2.2.4.8 to issue Subscriber Certificates.
2026-03-15	4.2.2.2.2	DNSSEC validation MUST be performed on all DNS queries associated with CAA record lookups performed by the Primary Network Perspective.
2026-03-15	4.2.2.2.4	CAs MUST NOT use local policy to disable DNSSEC validation on any DNS query associated CAA record lookups.
2026-03-15	4.2.2.2.5	DNSSEC-validation errors observed by the Primary Network Perspective (e.g., SERVFAIL) MUST NOT be treated as permission to issue.
2026-03-15	4.2.1	Subject Identity Information validation maximum data reuse period is 398 days.
2026-03-15	4.2.1	Domain Name and IP Address validation maximum data reuse period is 200 days.
2026-03-15	4.2.2	CAs SHALL NOT issue Certificates containing Domain Names that end in an IP Reverse Zone Suffix.
2026-03-15	6.3.2	Maximum validity period of Subscriber Certificates is 200 days.
2026-03-15	7.1.2.4	CAs MUST NOT use Precertificate Signing CAs to issue Precertificates. CAs MUST NOT issue certificates using the Technically Constrained Precertificate Signing CA Certificate Profile specified in Section 7.1.2.4.
2026-07-15	5.4.1	Audit logs of verification activity MUST include specific information.
2026-09-15	7.1.3.2.1	Sunset all remaining use of SHA-1 in Certificates and CRLs.
2026-11-15	3.2.2.4	Authorization Domain Names must be derived based on the validation method to be used.
2027-03-15	3.2.2.4 and 3.2.2.5	CAs MUST NOT rely on Methods 3.2.2.4.16, 3.2.2.4.17, 3.2.2.5.2, and 3.2.2.5.5 to issue Subscriber Certificates.
2027-03-15	3.2.2.5.3	CAs MUST NOT rely on Method 3.2.2.5.3 to issue Subscriber Certificates.
2027-03-15	4.2.1	Domain Name and IP Address validation maximum data reuse period is 100 days.
2027-03-15	6.3.2	Maximum validity period of Subscriber Certificates is 100 days.
2027-03-15	4.2.2.1.2	CAs MUST process the accounturi and validationmethods parameters as specified in RFC 8657.
2027-03-15	4.2.2.1.2	If the CA does not identify the Subscriber account via an ACME Account URL as described in RFC 8555, the CA MUST define the supported format of the accounturi in Section 4.2 of their CP and/or CPS, and SHOULD comply with the acct URI scheme defined in RFC 7565
2028-03-15	3.2.2.4 and 3.2.2.5	CAs MUST NOT rely on Methods 3.2.2.4.4, 3.2.2.4.13, and 3.2.2.4.14 to issue Subscriber Certificates.
2029-03-15	4.2.1	Domain Name and IP Address validation maximum data reuse period is 10 days.
2029-03-15	6.3.2	Maximum validity period of Subscriber Certificates is 47 days.