| |||||||||||||
Fraudulent certificates in the wild — againFraudulent certificates in the wild — againPosted Jan 21, 2013 16:10 UTC (Mon) by Jonno (subscriber, #49613)In reply to: Fraudulent certificates in the wild — again by dlang Parent article: Fraudulent certificates in the wild — again
Not quite, while openssl will by default copy those fields from the certificate request to the certificate, there is no such requirement by the specification.
For example, StartSSL will ignore the metadata in the certificate request, (only using its public key) and instead use the CN (common name) and subjectAlternateName from the web form used to make the request, and O, L, ST, C, emailAddress (organization, location, state, country, email) from the validation they did of you.
For EV certificates, all certificate vendors promise (to the browser vendor) to do this, and additionally to do a slightly more thorough validation than what StartSSL does for normal certificates, but the principle is the same.
(Log in to post comments)
|
|||||||||||||