<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 26 Mar 2015, at 8:46 am, Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com" class="">Dean_Coclin@symantec.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(31, 73, 125);" class="">We disagree with this line of thinking. Today someone can pay a few dollars and secure *.<a href="http://example.com/" style="color: purple; text-decoration: underline;" class="">example.com</a>, where the result is [high-risk].<a href="http://example.com/" style="color: purple; text-decoration: underline;" class="">example.com</a><span class="Apple-converted-space"> </span>with the most limited form of authentication. However a legitimate organization that successfully passes EV verification cannot order that same certificate. This makes zero sense — in fact, since the concern is with the exploit, this logic means that wildcards would be forced to the least authenticated customers. Hence we would support wildcards for EV certs.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(31, 73, 125);" class=""> </span></div></div></div></blockquote><br class=""></div><div>I don’t believe this is correct; a legitimate organization that passes EV verification can order that same certificate, and no further validation is required. What they can’t do is get it marked as EV.</div><div><br class=""></div></body></html>