[cabfpub] EV Wildcards

[Eddy Nigg]

On 03/20/2015 02:18 AM, Ryan Sleevi wrote:
> Wildcards are the best chance the Internet has to moving to a secure 
> world, and prohibiting or restricting them does nothing (from this 
> browsers point of view) to improve security, and would actively harm 
> TLS adoption.

I don't think so - there is no reason to stated multiple host names (sub 
domains) in a certificate. Nothing prevents from having many sub domains 
stated in the certificates (as with EV). Wild cards are really only 
necessary for some dynamic applications (sites that add or remove 
dynamically sub domains) or for the lazy.

If it's for the latter I don't see a good reason why not to require a 
higher verification, for the former also not because there is a real 
need for it.

For those that want to abuse wild cards, it becomes uninteresting if a 
verification (and publication of the details in the certificate) is 
required.

-- 
Regards
Signer: 	Eddy Nigg, COO/CTO
	StartCom Ltd. <http://www.startcom.org>
XMPP: 	startcom at startcom.org <xmpp:startcom at startcom.org>
Blog: 	Join the Revolution! <http://blog.startcom.org>
Twitter: 	Follow Me <http://twitter.com/eddy_nigg>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20150320/319d6b3c/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4313 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.cabforum.org/pipermail/public/attachments/20150320/319d6b3c/attachment-0001.p7s>