3 ms·
The main intention is that the CA is able to run its own phishing checks on every (sub)domain and deny the issuance of a high assurance certificate to it. Other
by iancarroll 12y ago
The main intention is that the CA is able to run its own phishing checks on every (sub)domain and deny the issuance of a high assurance certificate to it. Otherwise, you might be able to do something like what nailer said.
CAs explicitly deny issuance to domains that have popular brand names in them - issuing a certificate for comodo.ian.sh would not be possible in most circumstances. I doubt the CA/B Forum wanted that workaround for EV as well.
- chinathrow 12y ago"CAs explicitly deny issuance to domains that have popular brand names in them" That requirement only is so incredibly stupid and gives no more safety than not being there. Who draftet this crap, seriously? What popular is changes rapidly, sometimes overnight.
- nailer 12y ago> What popular is changes rapidly, sometimes overnight. That's correct. CAs also check for TLDs in unusual places (and unicode hacks, etc) in the requested SANs (Subject Alt Names, practically server names) during verification.