On: Extended Validation Certificates Are Dead

[dagenix]

Except that HPKP is being deprecated by Chrome (https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...). And I'd suspect other browsers will follow.

[BillinghamJ → dagenix]

I don’t mean website pinning. I mean eg apps etc

[sandij → dagenix]

When pinning CAs instead of certificates, you’d use CAA instead of HPKP.

[toast0 → sandij]

CAA isn't restricting acceptance of certs, it's restricting issuance, assuming the attempted issuer is compliant, competent, and that your domain didn't get hijacked.

[BillinghamJ → sandij]

That wouldn’t work, as there’s no differentiator between EV and non-EV