Sorry for the late reply: > 30 minutes doesn't seem nearly sufficient to reliably verify someone's identity. It's actually not that long of a process once you

Sorry for the late reply: > 30 minutes doesn't seem nearly sufficient to reliably verify someone's identity. It's actually not that long of a process once you read over the CPS's of a few CAs and the EV baseline. > How do we know? Ah, the golden question! Hopefully CT (certificate transparency) will sort this out within the next 3 years. My statement is an assumption but any high level fraud (e.g. Google/MSFT) is caught immediately (chrome pinning/reporting and internal CA logs, if you're not DigiNotar). I don't know about small companies though. I don't think there's ever been a maliciously issued EV cert in the context of the ComodoHacker and other very public hacks. They typically have tighter internal controls, that I know (e.g. RAs have very limited EV issuance power) but I have no numbers. :( You should note that EV implies DV validation, so to, without hacking, maliciously issue a certificate an attacker would probably settle for a DV cert.