Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color in the address bar and the name of the organization highlighted.

enter image description here

But what about the Domain Validation and Organization Validation certificates. Obviously the latter provides a better level of trust. So the question is how does the end user find out what kind of certificate the site is using. I tried viewing the certificate in the browser (firefox) but could not find anything relevant.

p.s. I searched more over the internet and even the answer by Tidalwave points out that there is no real way for a user to find out. So this means that for the end user there are only two types of certs EVSSL and non-EVSSL Doesn't this defeat the whole purpose of having DV and OV?

share|improve this question

1 Answer 1

Why would you think that you can trust companies officially registered in some countries more than you can trust registered domains hosted in any?

EV has obvious advantage with stricter validation, differences in trustworthiness between the other two however are rather moot. Browser vendors supporting EV simply didn't feel the need to agree on a separate visual identification of the other two (OV, DV) verification models, as neither provide a clear advantage one over the other (if any at all).

In short, none of the major browser vendors felt the need or want to differentiate between the two and stand behind it with their name. Good that they didn't, too. If companies can withstand scrutiny EV brings, then no one is stopping them to apply for such certificate. On the other hand, there are clearly also needs for cheaper certificates where additional verification wouldn't fit within their price range. Browser vendors (and user interfaces of some other software vendors) with EV support however don't stand by these cheaper certificates in any other special way than what is already there as per usual, for reasons mentioned before.

As for the other part of your question (visual inspection of certificate data), OV and DV would differ in their description where OV usually holds more data about the company it was issued for, but that's about it. This additional information display can vary across different clients, tho. That image you're attaching is however from Wikipedia, and you didn't mention what browser you were inspecting detailed certificate information in, so I can't say what differences you'd be able to see in an unknown browser.

Extended Validation Certificate display in Mozilla Firefox.

Example of Extended Validation certificate in Mozilla Firefox (above).

EDIT: DV certificate contains no identifying information in the organization name field. Typically, this value just re-states the domain name or simply says "Persona Not Validated", "(unknown)" et cetera. This is not standard for all CAs tho. Another way would be to inspect policy identifier (if present) where 2.23.140.1.2.1 stands for DV, and 2.23.140.1.2.2 for OV. Again, this is not adopted by all CAs. In short, there is no deterministic way to tell if a certificate was Domain or Organization Validated.

Domain Validated Certificate display in Mozilla Firefox.

Example of Domain Validated certificate in Mozilla Firefox (above). Notice the lack of meaningful data in the organisation information field.

share|improve this answer
    
you have a point but if it is not helping the end user's trust then what is the point of having these two types of certificates –  Shurmajee May 1 '13 at 6:04
    
@MayankSharma - There is still a substantial difference in the validation process between the two which is supposed to facilitate end user trust of OV > DV. I'm just saying that this might (in some cases, not all or even majority) be a bit moot and should be up to end users themselves to decide on which to trust more, not browser vendors to suggest this by means of visual notification. Certification facilitates this trust to a varying degree in case of DV and OV, and less so in case of EV, which is its main selling point. The rest is politics and not for me to judge. –  Noordung May 1 '13 at 12:28
    
But that is the question..how does the user find out the kind of certificate a site is using? –  Shurmajee May 1 '13 at 16:00
1  
DV certificate contains no identifying information in the organization name field. Typically, this value just re-states the domain name or simply says "Persona Not Validated". This is not standard for all CAs tho. Another way would be to inspect policy identifier (if present) where 2.23.140.1.2.1 stands for DV, and 2.23.140.1.2.2 for OV. Again, this is not adopted by all CAs. In short, there is no deterministic way to tell if a certificate was Domain or Organization Validated. I guess in Firefox, you would see meaningful data under which is run by for OV, and none or generic for DV. –  Noordung May 1 '13 at 16:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.