"Its methodology is not capable of discovering internal certificates that are not associated with a public certificate," the SSAC said. "Since the key purpose for internal name certificates is for internal use, it is highly likely that many internal certificates are unaccounted for."
The CA/Browser (CA/B) Forum, an organization of certificate authorities and browser vendors that drafts and publishes guidelines for the issuance of publicly trusted certificates, asked its CA members in July 2012 not to issue new certificates for internal server names that have an expiration date beyond Nov. 1, 2015. On Oct. 1, 2016, all CAs are expected to revoke the remaining certificates for internal server names that are still valid on that date, putting a permanent end to this type of certificate.
"Although this is welcome news, this is still problematic because ICANN plans to delegate new TLDs in 2013, introducing vulnerability for potential new gTLDs until October 2016," SSAC said.
ICANN reached out to the CA/B Forum about the problem and presented the SSAC's advisory at the organization's annual meeting in February. As a result, the CA/B Forum passed a ballot requiring all CAs to cease issuing new certificates that include gTLDs within 30 days of those gTLDs becoming operational. The CAs will also have to revoke all existing certificates for domain names under a new gTLD within 120 days after ICANN publishes the contract for that respective gTLD on its website, unless certificate owners register their private domain names publicly under the new gTLD.