Digicert Withdraws from the CA Security Council
Note that this is not the CA&#x2F;Browser Forum, the usual industry association you hear about. The CA Security Council is a group of a small number of old-guard CAs, which has been notable recently for pushing a distinction between (automatic) domain validation, organizational validation, and Extended Validation, mostly as a response to Let&#x27;s Encrypt. The &quot;London Protocol&quot; appears to be a proposal for formalizing the distinction between DV and OV + EV: <a href="https:&#x2F;&#x2F;casecurity.org&#x2F;2018&#x2F;06&#x2F;27&#x2F;the-london-protocol&#x2F;" rel="nofollow">https:&#x2F;&#x2F;casecurity.org&#x2F;2018&#x2F;06&#x2F;27&#x2F;the-london-protocol&#x2F;</a><p>If you look at this previous paper they (Entrust + Comodo) published, they&#x27;re proposing that OV and EV certificates get padlocks and DV ones don&#x27;t: <a href="https:&#x2F;&#x2F;casecurity.org&#x2F;wp-content&#x2F;uploads&#x2F;2017&#x2F;09&#x2F;Incidence-of-Phishing-Among-DV-OV-and-EV-Websites-9-13-2017-short-ve....pdf" rel="nofollow">https:&#x2F;&#x2F;casecurity.org&#x2F;wp-content&#x2F;uploads&#x2F;2017&#x2F;09&#x2F;Incidence-...</a> Or, in other words, you can&#x27;t get a padlock from Let&#x27;s Encrypt and you&#x27;ll have to pay them for a padlock.<p>Compare with Google&#x27;s plan at 
<a href="https:&#x2F;&#x2F;blog.chromium.org&#x2F;2018&#x2F;05&#x2F;evolving-chromes-security-indicators.html" rel="nofollow">https:&#x2F;&#x2F;blog.chromium.org&#x2F;2018&#x2F;05&#x2F;evolving-chromes-security-...</a> which just drops the padlock for <i>everyone</i>, treats plaintext HTTP as affirmatively insecure, and stops pretending that paying money to a CA means that you&#x27;re a morally upright website.<p>A CA leaving the CASC seems like a good thing for the world.