See also Certificate Transparency (RFC6962) which I haven't seen mentioned in this thread yet - the goals of which are to require all certificates be written to

See also Certificate Transparency (RFC6962) which I haven't seen mentioned in this thread yet - the goals of which are to require all certificates be written to publicly auditable, tamper-proof logs in order to be considered secure by clients. In such a manner certificate mis-issuance will be easy to detect for interested parties. As of earlier this year Chrome is already requiring Signed Certificate Timestamps for new EV certificates in order to display the EV indicator. https://tools.ietf.org/html/rfc6962 https://tools.ietf.org/html/rfc6962 http://www.certificate-transparency.org/ http://www.certificate-transparency.org/ (disclaimer: I work on this project)