# WEB-073 — The brand website must serve a certificate that verifies

> The brand website must present a valid TLS chain — not expired, not self-signed, and issued for the hostname actually submitted.

- **Rule ID:** WEB-073
- **Layer:** Website (`WEBSITE`)
- **Checks:** `brand.website TLS chain`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Fix the website — no form edit clears it
- **Required by:** Bandwidth, TCR, Twilio, Plivo
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/website/web-073/

## Why this rule exists

A vetting crawler stops at a certificate error and never reads a word of the site, so the rejection arrives as "the website could not be verified" rather than as anything about a certificate. Browsers hide this: the people who work at the business have been clicking through the warning for months, and a certificate valid for the bare domain but not for the www form fails only for whoever submitted the other one.

## How to fix it

Reissue the certificate for the exact hostname in brand.website, covering both the www and bare-domain forms, and renew before expiry. Done when an external SSL checker — not your own browser — reports a complete, valid chain for the URL you are about to submit.

## Common mistakes

- A certificate valid for acmecoffee.com and not for www.acmecoffee.com fails whenever the submitted URL uses the other form. Submit the form the certificate actually covers.
- An expired intermediate is invisible in Chrome, which caches the issuer, and fatal to a strict crawler that does not. Test from outside your own network.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| Bandwidth | `1103` | yes |
| Bandwidth/DCA | `2103` | yes |

## Notes

Absorbs BRD-128, which states the same certificate requirement from the brand-record side. Severity divergence in the catalog: website-evidence-012 and CARR-008 grade a TLS failure HIGH; Bandwidth, Plivo and Twilio grade it BLOCKING. Strictest kept.