They can do this with certificate transparency other wise CA can sign whatever date they want. But if they collude with CT that can issue rouge certificates for targeted attacks.
Yes, that's all right, there's already a requirement that they submit to one Google CT log and one non-Google CT log. They thought about it already. The playbook I mentioned they've been rehearsing contains specific threat against backdating certs, they say they'll distrust immediately if they detect, and they have means of detecting backdating on significant scale (esp. for LE, where they submit 100% issued certs, not just the subset that is intended for consumption with Chrome).
EV certs show the company name and the country, for disambiguation, on the assumption that you cannot have two companies of the same name in the same country. However, this is not true in the USA, where names are unique only within each state.
That's how someone got an EV cert for Stripe (USA).
reply