User: Password:
|
|
Subscribe / Log in / New account

Fraudulent certificates in the wild — again

Fraudulent certificates in the wild — again

Posted Jan 21, 2013 9:19 UTC (Mon) by dlang (subscriber, #313)
In reply to: Fraudulent certificates in the wild — again by giraffedata
Parent article: Fraudulent certificates in the wild — again

> many probably realize that even a non-EV certificate has some verification of the information and give the web site correspondingly higher respect if the name of the organization is vouched for than if only the domain name is.

umm, the CA organizations don't fill out any of these fields, they are filled out by the org that submits the signing request.

The fact that LWN.net's cert doesn't list an organization doesn't tell you anything other than the fact that the LWN cert request didn't have that information in it when it was submitted to the CA


(Log in to post comments)

Fraudulent certificates in the wild — again

Posted Jan 21, 2013 16:10 UTC (Mon) by Jonno (subscriber, #49613) [Link]

Not quite, while openssl will by default copy those fields from the certificate request to the certificate, there is no such requirement by the specification.

For example, StartSSL will ignore the metadata in the certificate request, (only using its public key) and instead use the CN (common name) and subjectAlternateName from the web form used to make the request, and O, L, ST, C, emailAddress (organization, location, state, country, email) from the validation they did of you.

For EV certificates, all certificate vendors promise (to the browser vendor) to do this, and additionally to do a slightly more thorough validation than what StartSSL does for normal certificates, but the principle is the same.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds