Extended validation certificates
Posted Nov 2, 2006 12:08 UTC (Thu) by gerv
Parent article: Extended validation certificates
The CA/Browser forum website is now up at http://www.cabforum.org; you can download a copy of the current draft of the vetting guidelines from there. (The link's in the header, a little bit hidden for some reason.)
A few inaccuracies in the article:
Because CAs have traditionally done very little in the way of validation
Some CAs would dispute that; they would claim that new entrants to the market have done less validation, thereby driving certificate prices down and pulling the other CAs with them, and that this is a relatively new phenomenon.
Verisign has generated a new set of keys to sign the EV certificates and Microsoft has already incorporated that public key into IE7.
Not so; the same roots are used. The new certificates are marked with a new policy OID.
Mozilla has EV on its radar and it is listed as a feature to be added
It was somewhat difficult for us to discuss this while the draft was secret; now that it's public, join the discussion in the mozilla.dev.security newsgroup.
Unless the verification of the entity is extremely thorough (which would be very costly), it is unclear that EV certificates will really do anything to change that.
That's the fallacy of unobtainable perfection.
Even then, few people actually look at the name attached to an SSL certificate, and many might be surprised at the names that show up if they did.
...which is why the IE UI, at least, puts the company name in the chrome.
The end result is that anyone wanting to abuse HTTPS will figure out a way to get a signed EV certificate
I'm impressed that Mr Edge can draw that conclusion having never seen the EV vetting guidelines!
to post comments)