Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

To establish trusted SSL connection I need to create a certificate request. For example, if I use openSSL I can do it by the following command:

openssl req -new -key privkey.pem -out cert.csr

Anyone can do it. I wander how CA ensures that a certificate request is coming from me? Maybe somebody else create a certificate request on behalf of me. Maybe my mail to CA was hacked and a certificate request was replaced. Can I sign my certificate request and to send my signing public key to CA (e.g. in the separate mail)? In this case it is possible to ensure that a certificate request is coming from me.

share|improve this question

1 Answer 1

up vote 9 down vote accepted

Different CAs have different methods, and each CA has different methods based on what level of trust you are paying to have. (such as Extended Validation to get the green address bar)

The little fly-by-night CAs have a base level verification where you just give them an e-mail address and they send you an e-mail there, thereby validating that you really own the e-mail address associated with the certificate. These usually cost $15-$30, and are promoted as instant verification.

Standard CA validation involves providing a phone number for at least one contact at your company. The CA first looks up the phone number to verify that it belongs to the company the cert is registered to, then checks by calling and having the contact answer the phone and agree that they know of this cert request.

Higher level verifications involve faxing company documents (business license, registration, etc)

...so to keep it short, it depends on what kind of trust you pay for and which company is sticking their neck out for you.

share|improve this answer
5  
Another approach some take is to have an entry added to the DNS record of the domain. It's still more or less an instant validation but it proves control over the domain rather than simply control of an e-mail address. Some also send an e-mail to the WHOIS contacts. –  AJ Henderson Jun 1 '13 at 3:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.