<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 03/20/2015 09:56 PM, Dean Coclin
wrote:<br>
</div>
<blockquote
cite="mid:14D026C7F297AD44AC82578DD818CDD038F063882E@TUS1XCHEVSPIN35.SYMC.SYMANTEC.COM"
type="cite">
<pre wrap="">"If mywebshop.appspot.com has an EV cert, what I want to know is who is running that business, and how I contact _them_ (or what info I can give to the police). Contact info for Google is not very useful in that circumstance!"
Gerv-I feel the same way when I see a site that has an OV cert issued to Cloudflare. The website business has nothing to do with Cloudflare yet all I can see in the cert is Cloudflare's name and OU info with about 20-30 SANs for unaffiliated names. And I'm not even sure how those names were vetted. As you said in the face to face, this is not a good situation.
</pre>
</blockquote>
<br>
But Dean - Cloudflare could get an EV certificate for all those
20-30 domain names and sites anyway according to the current EV
guidelines. Nothing prevents them from doing that technically.<br>
<br>
So if you really mean what you say you should try to change the EV
guidelines (which I'd support). But even then, it still doesn't have
really anything to do with wild cards. <br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>