11

I have been carrying out some work on SSL certificates and found that there are some places that charge you for an SSL certificate, but, how do they obtain the rights to do so? And, how, are they allowed to be on a list of "trusted" sites that the browser can identify as genuine?

  • Please share with us some results from your research. – Deer Hunter Oct 30 '15 at 13:43
13

The big browser companies (Google, Mozilla, Microsoft, Apple and Opera, mainly) include whatever root certificates from certification authorities they want to -- there are no government regulations or laws governing it. However there is a voluntary body called the CA/Browser Forum that lays down standards, and since all of the browser companies listed above are members then in practice a certification authority has to meet those standards to get their certificate included.

  • Thank you. So if a company wanted to say to it's customers "Before we give you a certificate, you must ensure that XYZ is done on your site to ensure security" is that possible? – Phorce Oct 30 '15 at 13:51
  • @Phorce The CAs aren't actually given anything, it's the other way around. The browsers and OS makers distribute root CA certificates with the browser, or OS. They have rules that the CAs must abide by for the browser/OS makers to continue distributing the CAs certs. They can also be revoked at any time, and this has happened in the case of DigiNoTar. – Steve Sether Oct 30 '15 at 14:06
  • 3
    A cert is only used to prove identity, not security of a site @phorce. Anything a CA asks of you will be to ensure you are entitled to the cert. – Neil Smithline Oct 30 '15 at 14:06
  • Furthermore, all SSL certs provide the same encryption (for a given bit length). So the $9 and $1,000 SSL certs provide the same encryption, but may offer different levels of site credibility (although this doesn't matter as much today as it did in the early/mid 2000's, as-in a Verisign $1,000+ SSL cert today is likely to be as-trusted by devices and browsers as the $9 GeoTrust SSL cert). – SnakeDoc Oct 30 '15 at 16:46
5

In order for a certificate to be accepted there must be a chain of trust from a root certificate in the clients trust store.

Typically the root certificate is not used to sign end entity certificates directly. Instead an "intermediate certificate" is created. The advantage of this is that intermediate certificates can be more easilly revoked if compromised but a compromised intermediate certificate is still a very serious security issue as revocation is a fragile process.

To get their root certificate included in the trust store of major browers CAs have to commit to following certain procedures and to being audited. Unfortunately audits are of limited utility because it's virtually impossible to prove that copies of the private key to the root or intermediate certificates don't exist outside of the audited infrastructure.

CAs with their root certificates in the browser can also issue intermediate certificates to other entities making those entities essentially CAs. The root certificate holder is supposed to take responsibility for the actions of their subordinates but again it's virtually impossible to prove that the keys to the intermediate certs are well controlled.

Recently browser vendors have started taking a greater interest in the activities of CAs and in particular they have started actively looking for misissued certificates in use on the internet. They have also introduced a system called "certificate transparency" which if enforced will require CAs to publiclly declare certificates before they are accepted as valid.

Some sites that sell certficates are run by CAs that hold root certificates. Some are run by organisations that hold intermediate certs but not root certs. Many are just resellers passing certificate requests to organisations in the first two categories.

2

In order to be included in the "Certificate Store" containing the Root CA references of major web browsers or operating systems vendors (Apple, Microsoft, Mozilla, Linux), you have to meet the industry standards defined by the CABBrowser Forum.

It is also required that your CA infrastructure complies with other aspects such as processes (how to obtain a certificate, where are the private keys stored, how do you certify the identify of the requestors, etc.). In order to prove your compliance your CA will be audited. Traditionally it's done by one of the Big Four audit firms. This expansive procedure is not a one-off process; you have to renew your certification regularly.

For example, Mozilla has defined the following procedure to be included in their web browsers.

  • So when, for example, I buy a SSL certificate from fasthosts, its them who have been audited etc..? – Phorce Oct 30 '15 at 14:20
  • It looks like fasthosts has a certificate which hast been signed from Thawte. If you buy a cert from fasthosts, it will be reselled by fasthosts. – Kami Oct 30 '15 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.