The London Protocol

Amidst an increasing number of phishing reports involving digital certificates, several Certificate Authorities (CAs) have banded together. For the first time, these arbiters of digital trust are cooperating in an effort to proactively ensure the certificates they’re providing (OV and EV Certificates, see below) to financial institutions and others are worthy of the trust that consumers place in them.

In late June — less than a month before Google released the 64th version of its Chrome browser, which began labeling unencrypted websites as unsafe — Comodo CA, Entrust Datacard, GlobalSign, GoDaddy, and Trustwave came to a broad agreement. Dubbed the London Protocol, the pact was announced by the CA Security Council during a CA/Browser Forum event in its namesake. It boils down to an initial promise to share URLs amongst themselves that have been flagged as potentially malicious through an agreed upon protocol.