1

Let's check this executable...

This digital signature is OK.

Ok fine.

Name: Cocoa Nuts Unicorns Ltd

Uhm that does not tell me anything.

So, I have a valid signature and a valid certificate. How do I know more about the owner than just the displayed name? I tried going to issuer's site with no luck, lots of links to how to buy a certificate but no information about cert owners. This applies to TLS certs too.

1

Certificates do not by definition proof who is behind it. If you trust that 'source' is entirely up to you. This is why most 'secure' connections made with certificates are for confidentiality and integrity, but you still don't know who you are talking to. CAs do have rules that tell the certificate owners not to share the private key, but in practice that is very hard to check.

You can also go up the chain and say 'I don't know Coca Nuts Unicorns Ltd, but I do know the authority higher up the chain, Verisign for example.' If verisign is ok with it, maybe so are you? This is a slippery slope though, because CAs will hand you a certificate as long as you give them some money, some account info and a email address. You just can't be sure of who is behind that certificate.

There is a concept with certificates, extended validation, which does help you out there. The basics of that concept are that the owner had to get validated by the certificate authority.

An Extended Validation Certificate (EV) is a certificate used for HTTPS websites and software that proves the legal entity controlling the web site or software package. Obtaining an EV certificate requires verification of the requesting entity's identity by a certificate authority (CA). Web browsers show the verified legal identity prominently in their user interface, either before, or instead of, the domain name. During software installation, the verified legal identity is displayed to the user by the operating system (e.g., Microsoft Windows) before proceeding with the installation.

See: https://en.wikipedia.org/wiki/Extended_Validation_Certificate

  • Isn't thumbprint identifying the certificate? I don't think that private key is essential for that. – Euri Pinhollow Feb 6 '17 at 12:32
  • @EuriPinhollow the point about sharing the private key is that once the key is compromised, anyone can pass as the certified entity. – Mindwin Feb 6 '17 at 12:36
  • @Mindwin: Bingo. The idea is that it is a private key and thus only known to one party (in theory, you could have a business case for spreading the private key out to several loadbalancers for example, but ideally you would find a better way to do it, like store the key in one place and let the servers that need it access it.). If everyone knows the key, then you cannot be sure about who it is your are connecting to/trusting. – saekort Feb 6 '17 at 13:44
  • @saekort & anyone interested in further reading: Server Fault: Does each server behind a load balancer need their own SSL certificate? – Mindwin Feb 6 '17 at 14:14
  • @Mindwin of course I know that! The private key exposure seems to be completely unrelated to my question because there are other ways of identifying certificates. – Euri Pinhollow Feb 6 '17 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.