If anyone is interested:
https://github.com/mieko/greenbar
I should probably chart out the changes throughout the years, but this was more of a curiosity hack.
I believe the only possible advantage of an EV is not a technical one, but rather an organizational one: it encourages the use of a single keypair on each server because Wildcard coverage is not allowed (although multi-domain is allowed). For what appear to be non-technical reasons, I have seen many entities copying their keypairs for Wildcard certs between servers, even between business critical on-prem backends and cheap shared hosting or budget VPS, or handing the keypair over to a contractor via email.
However, there are obligations to display 2-QWACs if sites choose to use them. Their keys are not used to authenticate web domains or encrypt web traffic.
Disclosure: I was Mozilla's lead for this effort and also helped design 2-QWACs (for my sins).
Though I don't understand why they would atone for any sins. IMHO, you created the website identity infrastructure for the agentic web...
And yes, I hope I didn't imply that QWACs are trusted by default for TLS. 1-QWACs would have to come from an existing trusted CA to be recognized by the browser.
All the design needed was for the browser to check the TLS cert and the QWAC cert covered the same domain name. Instead, folks at ETSI insisted very stubbornly on the signature from the QWAC over the cert used in TLS - which is an annoying complication for site operators - and provides little additional benefit.
I'd also like to see the EU encode more information in these certs. Knowing a company's address is not very useful (IMO), but a machine readable label that the site is regulated by $COUNTRY_NAME financial or medical regulator would be a much more useful signal.
Good luck in your endeavours!
Agree that the next step for 2-QWACs is additional corporate data (professional licensure like you mentioned, incorporation date) and eventually arbitrary claims vetted by a QTSP.
For an average human user, these additional claims are nearly useless since they're so buried in the browser UI...and even if they were more prominent, they wouldn't be of much benefit, as the EV history has shown.
But for an agent that knows to look out for these signals, extensible 2-QWACs will be extremely valuable.
As I recall, EV certificates also had the 'problem' that a lot of companies trade under names that aren't their full legal name, making the EV cert confusing. To use modern examples, twitter.com having an EV cert for "Space Exploration Technologies Corp", google.com having an EV cert for "Alphabet Inc" and suchlike.
Have seen some entities request a large number of EV certs (more than 10, sometimes up to 40) for subdomains under a single domain. At the same time, they are requesting OV Wildcard certificates for the main domain, which have overlapping coverage with the EV certs. These entities do not have any regulatory requirements to use EV as far as I know.
Is there any point in doing this?
The overlap from the Wildcard would seem to nullify any theoretical advantage of the EV cert, given that both will be recognized as valid certs that can cover the subdomains. This in addition to the fact that browsers do not treat EV, OV and DV certs differently in any significant user-facing way since many years now.
Frequently these entities also use Let's Encrypt DV certs on some subdomains alongside their EV certs, so of course a CAA record cannot be used to limit emissions to the CA which emitted the EVs.
Can anyone think of a legitimate technical motivation to use EV certs alongside an overlapping Wildcard OV and various DVs?
Back then, cert vendors would try to sell you on "premium" certificates.. telling you that cheap ssl certificates weren't good enough, so you needed to pay for $100-300+/yr certificate, and you could show to your visitors by displaying silly trust seals like the "Thwarte Seal".. as if customers would know who the hell Thwarte is.
Then this EV seal was launched, displaying what was essentially a trust seal in the browser.. and these same vendors would charge $500+/yr for it.
I can't express how great it is that EV certs died.
aleclindz•3d ago