4 ms·
> If MyCompany Inc buys an EV Cert from ReputableCertVendor (and another from IrreproachableCertVendor) and issues HPKP headers pinning to the EV intermediates
by pfg 9y ago
> If MyCompany Inc buys an EV Cert from ReputableCertVendor (and another from IrreproachableCertVendor) and issues HPKP headers pinning to the EV intermediates of those two vendors, then can't I have a reasonable expectation that those two companies will take measures to make sure they don't issue EV certificates for perceptually-similar domain names (and could I win a court case against them if they did)?
What is your goal here? Pins are per-domain (optionally including all subdomains). They wont affect similar domain names - browsers would accept a certificate from any trusted CA.
- philsnow 9y agoshit of course you're right, the article talked explicitly about people not differentiating between the EV browser treatment and the DV browser treatment, so all this iron cladding / gold plating on the domain i'm trying to protect doesn't stop typo squatters doing anything.