On Wed, Mar 8, 2017 at 1:02 PM, Ryan Hurst via dev-security-policy <
dev-security-policy@lists.mozilla.org> wrote:
> There are some limitations relative to where this domain information is
> used, for example
>  in the case of an EV certificate, if Google were to request Microsoft
> use this capability the
> EV badge would say verified by Google. This is because they display the
> root name for the
> EV badge. However, it is the subordinate CA in accordance with its CP/CPS
> that is responsible
> for vetting, as such the name displayed in this case should be GlobalSign.
> Despite these limitations, it may make sense in the case of Firefox to
> maintain a similar capability.

Outside of EV, can you articulate why (preferably in a dedicated thread)

There have been requests over the years from a variety of CAs for this.
Each time, they've been rejected. If there's new information at hand, or a
better understanding of the landscape since then, it would be good to
articulate why, specifically for Mozilla products :)
dev-security-policy mailing list

Reply via email to