I remember when these rolled out.. it was just an obvious cash grab by cert vendors, trying to create a trust-badge in collusion with browsers.

Back then, cert vendors would try to sell you on "premium" certificates.. telling you that cheap ssl certificates weren't good enough, so you needed to pay for $100-300+/yr certificate, and you could show to your visitors by displaying silly trust seals like the "Thwarte Seal".. as if customers would know who the hell Thwarte is.

Then this EV seal was launched, displaying what was essentially a trust seal in the browser.. and these same vendors would charge $500+/yr for it.

I can't express how great it is that EV certs died.

▲

ameliaquining 2 hours ago | parent [-]

The browser vendors, I think, were at least making a good-faith attempt to address a real security problem; it's not like they made any money from EV certificates. Even if it was inevitably going to be marketed somewhat predatorily, and ultimately didn't work out.

	▲	tialaramex 24 minutes ago \| parent [-]
		It was a bargain. The CAs wanted EV and the browsers wanted the BRs (Baseline Requirements). Before the BRs certificate validation quality had been on a dramatically steep race to the bottom. The BRs immediately stopped that, if your certs didn't meet the BRs that's an obvious red line, everybody can see - this was now the bottom. But they also (and this perhaps was less obvious) were incrementally improved. From the outset the intent was to keep meeting, at first to nail down everything in the agreement, but then to revise and improve the Baseline Requirements. Although there are some changes to make the lives of CAs easier, the vast majority of changes just tighten things up. For example the original BRs want to stamp out the practice of just making up DNS names. It seems crazy today, but in 2010 that's really a thing "legitimate" CAs would do and your browser would accept it. made-up.name.in.example "works" fine, a CA can issue the certificate, you can use /etc/hosts or equivalent and it all checks out - even though that's clearly nonsense - who could get such a cert? Anybody. So what possible value does it have? Well, somebody paid for the certificate. After the BRs go into force in July 2012 that's against the rules. It doesn't stop happening immediately, but it is now clearly forbidden, so at least they say "Sorry, won't happen again" and cross fingers they actually mean it. Likewise, the original BRs say certificates must only last 60 months. That seems like forever - and it is - but at the time some sites had 10 year certificates. Hey, if you agreed to pay $500 for a certificate, on condition that it's valid for a decade, what self-respecting sales person wouldn't sell that? The BRs say not to issue with terrible keys (yes, I know, that's ironic given what we found out this month) and lots of other basic "Duh obviously" stuff which alas was not apparently obvious enough that it wasn't news to at least one CA. By 2015 the BRs are telling CAs to stop issuing with SHA-1 hashes. They don't actually meet the deadlines in that document, but they're pretty close, I'm fairly sure that nobody actually got a bogus cert (as had definitely happened for MD5) though it may have been closer than we'd have liked. This is a success story, and EV certs were a very small price to pay.