Benefits to using EV certificates with a privately hosted Certificate Authority

Question

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate?

Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the external site (paypal.com), and pass that on to the internal user?

What other use cases, assurances, or benefits could an internally managed EV certificate offer?

Answer 1

Extended Validation (EV) certificates exist to give the end-user greater assurance that the web site is who they say they are. This is because the enrolment process that is followed by the Certificate Authority (CA) has meet a minimum standard (http://www.cabforum.org/Guidelines_v1_3.pdf).

The actual certificate features are the same EV or no EV so the certificate itself provides no extra encryption or security technology. The only change to the certificate is that a Certificate Practice Statement (CPS) that is recognised by the browser as being EV. If the CPS object identifier (OID) matches a list of OIDs known to be EV and the normal certificate validation passes, green is displayed in the browser.

For an internal network, this should make no difference because the level of verification of the host and the requestor is normally the same. If it makes sense in your environment by all means do it, however if you are trying to increase security then implementing Online Certificate Status Protocol (OCSP - http://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) would be more helpful. OCSP is supported by Bluecoat, Windows 2008 R2 CAs and a range of other products.

Support for intercepting EV SSL certificates from a Bluecoat appliance works but the certificate seen by the user will not have a CPS attached to the certificate so it will not appear green in the browser.

Hope this helps.

Answer 2

There should be no difference - a regular self-signed cert says "I'm telling you that I'm me", while an EV self-signed cert says "I'm really telling you that I'm definitely me". Neither statement is any more or less trustworthy than the other, and EV is about the level of confidence the CA (you) has in the identity of the certificate holder (also you).

That said, I wouldn't be surprised to find that some badly-written client software treats EV certificates as magically different regardless of the trust path.

Answer 3

A regular SSL certificate tells you: "this really the domain name example.com"

The EV certificate also tells you: "this really Example Ltd."

Fake certificates

Since "Example Ltd." is an official legal name, my guess is that it could be considered a misuse of a trade name, and Example Ltd. could sue. (But I also think that issuing a fake regular certificates for example.com goes against the rights of Example Ltd.)

I am NOT a lawyer.

Advantage of EV certificates for internal use

Instead of showing "name-of-bob's-computer.internal-domain" in the address bar, the browser will show "Joe's computer" in green!