Background
The CA/B Forum is a collaborative effort between Certificate Authorities (companies like DigiCert® that issue publicly-trusted certificates) and web browsers (companies like Mozilla or Microsoft that facilitate secure connections).
Because of these new requirements, Certificate Authorities (CAs) must immediately begin to phase out the issuance of SSL Certificates for internal server names or reserved IP addresses and eliminate (revoke) any certificates containing internal names by October 2016. In addition, the baseline requirements prevent CAs from issuing internal name certificates that expire after November 1, 2015. After 2015 it will be impossible to obtain a publicly-trusted certificate for any host name that cannot be externally verified.
These baseline requirements are also being incorporated into global auditing standards. They were included in the WebTrust and ETSI auditing standards for CAs on Jan 1, 2013. Once the requirements are adopted, browsers will require certification from auditors that a CA meets the baseline requirements prior to renewing their root certificate.
What is an Internal Name?
An internal name is a domain or IP address that is part of a private network. Common examples of internal names are:
Any server name with a non-public domain name suffix. For example,
www.contoso.local or server1.contoso.internal.
NetBIOS names or short hostnames, anything without a public domain. For example, Web1, ExchCAS1, or Frodo.
Any IPv4 address in the RFC 1918 range.
Any IPv6 address in the RFC 4193 range.