# POL-015 — The policy host must serve a valid certificate of its own

> The host serving the policy pages must present a valid TLS chain, checked independently of the brand website host.

- **Rule ID:** POL-015
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `privacy policy + terms URL TLS chain`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Fix the privacy policy or SMS terms
- **Required by:** Bandwidth, TCR, AT&T, T-Mobile, AWS
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-015/

## Why this rule exists

Policy pages are routinely hosted somewhere else — a docs subdomain, a help centre, a legal-template service — so the website's certificate says nothing about them, and a certificate failure on the policy host alone is enough to reject a brand whose marketing site is perfect. Bandwidth codes it as a standalone reject reason for exactly that reason.

## How to fix it

Renew or reissue the certificate for the policy host, including any subdomain the policy sits on, and test it from outside your network. Done when an external SSL checker reports a complete valid chain for both policy URLs.

## Common mistakes

- A wildcard certificate for *.acmecoffee.com does not cover a policy hosted on a vendor domain. Check the host in the URL you actually submitted, not the one you think of as yours.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Bandwidth | `7105` | yes |
| Bandwidth | `1103` | yes |

## Notes

Severity divergence in the catalog: TCR and the carriers rate a TLS failure MEDIUM, Bandwidth and AWS treat 7105 as a standalone rejection. Strictest kept. The website equivalent is WEB-073, and the two fail independently because the two hosts often differ.