A Kentucky Stripe and a Free Certificate Killed the EV Badge
Who killed the EV cert? A browser whodunit for Halloween
The green company name in the address bar once promised verified business identity, but browsers buried it after research showed users ignored it. Ian Carroll's Kentucky company, also named Stripe, Inc., showed how a valid EV certificate could borrow another firm's reputation. Let's Encrypt then made encryption free and universal, while phishing sites got the same lock. Now the EU's QWAC standard, mandatory from January 2027, and AI agents that can actually check identity may revive it.
A certificate could correctly identify Carroll's company which, with the company name alone, inherited the reputation of an entirely different business.
- sekinfo
Question for HN regarding EV certs:
Have seen some entities request a large number of EV certs (more than 10, sometimes up to 40) for subdomains under a single domain. At the same time, they are requesting OV Wildcard certificates for the main domain, which have overlapping coverage with the EV certs. These entities do not have any regulatory requirements to use EV as far as I know.
Is there any point in doing this?
The overlap from the Wildcard would seem to nullify any theoretical advantage of the EV cert, given that both will be recognized as valid certs that can cover the subdomains. This in addition to the fact that browsers do not treat EV, OV and DV certs differently in any significant user-facing way since many years now.
Frequently these entities also use Let's Encrypt DV certs on some subdomains alongside their EV certs, so of course a CAA record cannot be used to limit emissions to the CA which emitted the EVs.
Can anyone think of a legitimate technical motivation to use EV certs alongside an overlapping Wildcard OV and various DVs?
- galadran
Clarification: Browsers or other user-agents are not required to trust QWACs for use in TLS. We fought very hard for this.
However, there are obligations to display 2-QWACs if sites choose to use them. Their keys are not used to authenticate web domains or encrypt web traffic.
Disclosure: I was Mozilla's lead for this effort and also helped design 2-QWACs (for my sins).
- mieko
For nearly a decade, I've been occasionally tracking how many of the Cloudflare top-2K sites (earlier: Alexa) respond with an EV cert. And then also pull the SSL Labs score to see if there was any correlation.
If anyone is interested:
https://github.com/mieko/greenbar
I should probably chart out the changes throughout the years, but this was more of a curiosity hack.