Hacker News Reader

> DV SSL also allows someone to register '*.othercompany.com' wildcard and then create 'yourbank.com.othercompany.com' and have this domain name display a green lock in older browsers.

Wildcard certs only work one level down, when I looked into this Firefox was the last browser to remove support for doing multiple levels.

View on HN

So they could just register *.com.othercompany.com.

I'd say the EV provider should reject such a wildcard.

CertSimple argues (https://certsimple.com/blog/wildcard-ev-certificate) the EV restriction on wildcards is to prevent google.com.fraud.ru from getting an EV certificate. The single-level wildcard restriction already prevents that.

EV requirements reject all wildcards: the EV applicant must specifically list all domain names.

Re: your edit: as the other poster notes, the DV cert would have to be for '*.com.fraud.ph'. That's entirely possible though.

Reply on news.ycombinator.com