Extended Validation Certificates Are Really Dead
The irritating thing is that EV is the closest thing to a useful thing PKI can provide[1]. And the only reason it's being pushed out is because Google doesn't like it and hence Chrome has been retiring it. Google's previously indicated it essentially wants to build it's own system[2] that is... effectively EV. So this is probably the death of a problematic but fixable open system which will be replaced by a proprietary Google-owned one.Firefox, is, of course, following the monopoly lead.[1]HTTPS encryption itself doesn't meaningfully require public key infrastructure, it's just that without PKI, you don't know who sent the encrypted traffic. Since domains are terrible "identities" and it's common for large organizations to use many of them that sound similar to scam domains, domain validation really doesn't tell anyone anything about whether or not they're talking to a trustworthy entity.[2]Basically Google said it wants to "invent" EV certs here, late last year: https://www.wired.com/story/google-wants-to-kill-the-url/