Fraudulent certificates in the wild

Fraudulent certificates in the wild — again

Posted Jan 21, 2013 9:08 UTC (Mon) by giraffedata (subscriber, #1954)
In reply to: Fraudulent certificates in the wild — again by dlang
Parent article: Fraudulent certificates in the wild — again

what fields are filled in do not really matter.

Nonetheless, all the evidence is that having fields filled is in fact what people are buying with Startssl's $60 product. That product is not an EV certificate.

The people who buy the extended validation certs do pay a LOT more to have themselves scrutinized more, in exchange the browser puts the green bar when browsing to the site.

I would say they're paying to have the browser put the green bar up (more specifically, they're paying for an EV certificate). If they failed to be scrutinized more in the process, they wouldn't exactly demand a refund.

I think there probably is value, by the way, in having the Organization field filled in in a non-EV certificate. To the extent that a browser user pays any attention to the certified identity at all, many probably realize that even a non-EV certificate has some verification of the information and give the web site correspondingly higher respect if the name of the organization is vouched for than if only the domain name is.

(Log in to post comments)

Fraudulent certificates in the wild — again

Posted Jan 21, 2013 9:19 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]

> many probably realize that even a non-EV certificate has some verification of the information and give the web site correspondingly higher respect if the name of the organization is vouched for than if only the domain name is.

umm, the CA organizations don't fill out any of these fields, they are filled out by the org that submits the signing request.

The fact that LWN.net's cert doesn't list an organization doesn't tell you anything other than the fact that the LWN cert request didn't have that information in it when it was submitted to the CA

Fraudulent certificates in the wild — again

Posted Jan 21, 2013 16:10 UTC (Mon) by Jonno (subscriber, #49613) [Link]

Not quite, while openssl will by default copy those fields from the certificate request to the certificate, there is no such requirement by the specification.

For example, StartSSL will ignore the metadata in the certificate request, (only using its public key) and instead use the CN (common name) and subjectAlternateName from the web form used to make the request, and O, L, ST, C, emailAddress (organization, location, state, country, email) from the validation they did of you.

For EV certificates, all certificate vendors promise (to the browser vendor) to do this, and additionally to do a slightly more thorough validation than what StartSSL does for normal certificates, but the principle is the same.