<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 26 Mar 2015, at 3:03 pm, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Mar 26, 2015 at 2:59 PM, Geoff Keating <span dir="ltr" class=""><<a href="mailto:geoffk@apple.com" target="_blank" class="">geoffk@apple.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><span class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 26 Mar 2015, at 8:46 am, Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com" target="_blank" class="">Dean_Coclin@symantec.com</a>> wrote:</div><br class=""><div class=""><div style="font-family:HelveticaNeue;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" class=""><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=""><span style="color:rgb(31,73,125)" class="">We disagree with this line of thinking. Today someone can pay a few dollars and secure *.<a href="http://example.com/" style="color:purple;text-decoration:underline" target="_blank" class="">example.com</a>, where the result is [high-risk].<a href="http://example.com/" style="color:purple;text-decoration:underline" target="_blank" class="">example.com</a><span class=""> </span>with the most limited form of authentication. However a legitimate organization that successfully passes EV verification cannot order that same certificate. This makes zero sense — in fact, since the concern is with the exploit, this logic means that wildcards would be forced to the least authenticated customers. Hence we would support wildcards for EV certs.<u class=""></u><u class=""></u></span></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=""><span style="color:rgb(31,73,125)" class=""> </span></div></div></div></blockquote><br class=""></div></span><div class="">I don’t believe this is correct; a legitimate organization that passes EV verification can order that same certificate, and no further validation is required. What they can’t do is get it marked as EV.</div></div></blockquote><div class=""><br class=""></div><div class="">That depends on a CA-by-CA basis.</div><div class=""><br class=""></div><div class="">[high-risk] is a CA-dependent determination which the BRs don't normatively specify, and thus subject to a wide degree of interpretation regarding it. So you could shop EV CAs until you found a CA willing to do it.</div><div class=""><br class=""></div><div class="">It's not even a valid PR compliant, as was suggested elsewhere. It'd be two CA's bickering over what "high risk" means and whether "[some string]" is high-risk or not. The process/procedures of the EV process would have been fully followed. </div></div></div></div>
</div></blockquote></div><br class=""><div class="">I meant, they can order the same wildcard certificate. I’d hope there aren’t CAs who will allow orders for <a href="http://facebook.example.com" class="">facebook.example.com</a> even as DV.</div></body></html>