5 ms·

"Single server EV certificates are $469, multi server name certificates are $769. Both last two years." Why do you charge 300$ for 2 characters? Like the "*."

"Single server EV certificates are $469, multi server name certificates are $769. Both last two years." Why do you charge 300$ for 2 characters? Like the "*." for a wildcard cert?

nailer 12y ago
Our prices fall somewhere in the middle of the market: much less than Symantec, a little more than Comodo. We're faster than all of them. Each server name is manually verified by a human. Wildcards are explicitly banned by browsers and CAs when making the EV requirements: otherwise you get *.company.com being used for bankofamerica.com.company.com like what happened with DV certificates. See https://certsimple.com/blog/wildcard-ev-certificate https://certsimple.com/blog/wildcard-ev-certificate Edit, replying to BukhariH due to rate limit: that's an excellent question, and illustrates why server names are manually reviewed by a human. A company called 'Company' who asked for an EV cert for bankofamerica.com.company.com would be rejected during validation.
- BukhariH 12y ago
  "Wildcards are explicitly banned by browsers and CAs when making the EV requirements: otherwise you get *.company.com being used for bankofamerica.com.company.com like what happened with DV certificates." That doesn't make sense because the whole point of the green badge is that it shows the identity of who controls the website you're on. So, even if someone were to do: bankofamerica.com.foobar.com; the green badge wouldn't say "Bank of America Corporation" so the user would know they're not on BoA...
  - iancarroll 12y ago
    The main intention is that the CA is able to run its own phishing checks on every (sub)domain and deny the issuance of a high assurance certificate to it. Otherwise, you might be able to do something like what nailer said. CAs explicitly deny issuance to domains that have popular brand names in them - issuing a certificate for comodo.ian.sh would not be possible in most circumstances. I doubt the CA/B Forum wanted that workaround for EV as well.
    - chinathrow 12y ago
      "CAs explicitly deny issuance to domains that have popular brand names in them" That requirement only is so incredibly stupid and gives no more safety than not being there. Who draftet this crap, seriously? What popular is changes rapidly, sometimes overnight.
      - nailer 12y ago
        > What popular is changes rapidly, sometimes overnight. That's correct. CAs also check for TLDs in unusual places (and unicode hacks, etc) in the requested SANs (Subject Alt Names, practically server names) during verification.
- ryan-c 12y ago
  > Wildcards are explicitly banned by browsers and CAs when making the EV requirements: otherwise you get .company.com being used for bankofamerica.com.company.com like what happened with DV certificates. Name validation is supposed to, and generally does, forbid "." in the part represented by the .

"Single server EV certificates are $469, multi server name certificates are $769. Both last two years." Why do you charge 300$ for 2 characters? Like the "*." for a wildcard cert?

nailer 12y ago

Our prices fall somewhere in the middle of the market: much less than Symantec, a little more than Comodo. We're faster than all of them. Each server name is manually verified by a human. Wildcards are explicitly banned by browsers and CAs when making the EV requirements: otherwise you get *.company.com being used for bankofamerica.com.company.com like what happened with DV certificates. See https://certsimple.com/blog/wildcard-ev-certificate https://certsimple.com/blog/wildcard-ev-certificate Edit, replying to BukhariH due to rate limit: that's an excellent question, and illustrates why server names are manually reviewed by a human. A company called 'Company' who asked for an EV cert for bankofamerica.com.company.com would be rejected during validation.

BukhariH 12y ago
"Wildcards are explicitly banned by browsers and CAs when making the EV requirements: otherwise you get *.company.com being used for bankofamerica.com.company.com like what happened with DV certificates." That doesn't make sense because the whole point of the green badge is that it shows the identity of who controls the website you're on. So, even if someone were to do: bankofamerica.com.foobar.com; the green badge wouldn't say "Bank of America Corporation" so the user would know they're not on BoA...
- iancarroll 12y ago
  The main intention is that the CA is able to run its own phishing checks on every (sub)domain and deny the issuance of a high assurance certificate to it. Otherwise, you might be able to do something like what nailer said. CAs explicitly deny issuance to domains that have popular brand names in them - issuing a certificate for comodo.ian.sh would not be possible in most circumstances. I doubt the CA/B Forum wanted that workaround for EV as well.
  - chinathrow 12y ago
    "CAs explicitly deny issuance to domains that have popular brand names in them" That requirement only is so incredibly stupid and gives no more safety than not being there. Who draftet this crap, seriously? What popular is changes rapidly, sometimes overnight.
    - nailer 12y ago
      > What popular is changes rapidly, sometimes overnight. That's correct. CAs also check for TLDs in unusual places (and unicode hacks, etc) in the requested SANs (Subject Alt Names, practically server names) during verification.
ryan-c 12y ago
> Wildcards are explicitly banned by browsers and CAs when making the EV requirements: otherwise you get .company.com being used for bankofamerica.com.company.com like what happened with DV certificates. Name validation is supposed to, and generally does, forbid "." in the part represented by the .