Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For companies that have implemented their own internal CA, is there any benefit to configuring that CA to issue an EV certificate?

Do any SSL Proxies (like Bluecoat) mimic the EV certificate of the external site (paypal.com), and pass that on to the internal user?

What other use cases, assurances, or benefits could an internally managed EV certificate offer?

share|improve this question
    
Has this questions been answered or do you require more information? –  Bernie White Nov 8 '11 at 9:36
add comment

3 Answers

up vote 5 down vote accepted

Extended Validation (EV) certificates exist to give the end-user greater assurance that the web site is who they say they are. This is because the enrolment process that is followed by the Certificate Authority (CA) has meet a minimum standard (http://www.cabforum.org/Guidelines_v1_3.pdf).

The actual certificate features are the same EV or no EV so the certificate itself provides no extra encryption or security technology. The only change to the certificate is that a Certificate Practice Statement (CPS) that is recognised by the browser as being EV. If the CPS object identifier (OID) matches a list of OIDs known to be EV and the normal certificate validation passes, green is displayed in the browser.

For an internal network, this should make no difference because the level of verification of the host and the requestor is normally the same. If it makes sense in your environment by all means do it, however if you are trying to increase security then implementing Online Certificate Status Protocol (OCSP - http://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) would be more helpful. OCSP is supported by Bluecoat, Windows 2008 R2 CAs and a range of other products.

Support for intercepting EV SSL certificates from a Bluecoat appliance works but the certificate seen by the user will not have a CPS attached to the certificate so it will not appear green in the browser.

Hope this helps.

share|improve this answer
1  
On a related note, here is a MSFT blog that mentions how to make EV support happen in a private network: blogs.technet.com/b/askds/archive/2009/08/14/… –  makerofthings7 Jun 7 '12 at 4:47
add comment

There should be no difference - a regular self-signed cert says "I'm telling you that I'm me", while an EV self-signed cert says "I'm really telling you that I'm definitely me". Neither statement is any more or less trustworthy than the other, and EV is about the level of confidence the CA (you) has in the identity of the certificate holder (also you).

That said, I wouldn't be surprised to find that some badly-written client software treats EV certificates as magically different regardless of the trust path.

share|improve this answer
add comment

A regular SSL certificate tells you: "this really the domain name example.com"

The EV certificate also tells you: "this really Example Ltd."

Fake certificates

Since "Example Ltd." is an official legal name, my guess is that it could be considered a misuse of a trade name, and Example Ltd. could sue. (But I also think that issuing a fake regular certificates for example.com goes against the rights of Example Ltd.)

I am NOT a lawyer.

Advantage of EV certificates for internal use

Instead of showing "name-of-bob's-computer.internal-domain" in the address bar, the browser will show "Joe's computer" in green!

share|improve this answer
    
"Fake" certificates are issued all the time by SSL proxies such as the developer tool "fiddler" and corporate gatekeeping software "BlueCoat". Neither of those misuse trade names, but on the other hand, I don't think they mimic a EV cert either. (yet) –  makerofthings7 Sep 26 '11 at 1:52
    
@makerofthings I understand that making fake certificates (certificates signed without the consent of the subject) is useful for debugging, with the consent of consumer of the certificate. It seems to me that making up certificates, without the consent of the subject of the certificate and the consent of the person who use the certificate, is dishonest and unlawful. –  curiousguy Sep 26 '11 at 16:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.