3

I've found a page from Digicert that made me very confusing.

https://www.digicert.com/compare-and-buy-ssl-certificates/

In the "Technical Specifications" Section, it listed "Symmetric 256-bit encryption"
Digicert Technical Specifications In my opinion, the SSL certificate is only used to verify the identity of the server. The encryption strength is related to the configuration of the server.

For example, I would list a few CipherSuites:

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

The SSL certificate should only determin whether the bolded text is "RSA" or "ECDSA". And the other KeyExchange and Encryption method should be determined during the SSL handshake.

The real Symmetric encryption methods' names are what after "_WITH_"

Then my question is how can a SSL certificate determin the symmetric encryption strength? Shouldn't it be determined by the configuration od the server?

Sorry for my poor English ....

----------------Edited 2018.07.27 09:01 UTC----------------
I've found a reseller of Symantec that sell two kinds of SSL certificates, and the only differences between these two are encryption length and price.
The link is here: https://www.trustauth.cn/symantec-ssl
(You may use your browser's translate plugin tp translate this site) And here's a screenshot of the translated page: Screenshot of another confusing page I've ask their Pre sale consultation staff what are the differences between these two. They said that The certificate can determine the encryption strength!

Then... anyone knows whether Symantec(Digicert) sell two kinds of EV and OV certificates and distinguish them by EVPro,EV and OVPro,OV ?
I don't think there is any difference between these two kinds of certificates...

|improve this question
2

In my opinion, the SSL certificate is only used to verify the identity of the server. The encryption strength is related to the configuration of the server.

Correct, the certificate does not determine the strength of symmetric encryption at all. DigiCert is just ticking the expected buzzwords so that the users feel safe.

|improve this answer
  • Thank you for answering. However, in some CA sites, they differ the certificate that can support 128 bit and 40bit and call the 40 bit on Pro. For example trustauth.cn/symantec-ssl (you may try to use your browser's translate to view this site) – JemmyLoveJenny Jul 27 '18 at 8:58
  • @JemmyLoveJenny: same buzzword ticking - and nobody should use 40bit today anyway. The Pro version differ in that they support ECC certificates. Since there are no 40bit ECDSA ciphers they cannot claim support for 40bit here. – Steffen Ullrich Jul 27 '18 at 9:06
  • Wow, I see! Thank you very much! Another question is whether the certificate use SHA1 or SHA256? If the certificates are signed with SHA256, older browsers would not support it I think... And must Pro certificates use ECC keys or they can use RSA keys as well? – JemmyLoveJenny Jul 27 '18 at 9:19
  • @JemmyLoveJenny: I have no idea if the Pro gives you only ECC, if you can choose or if you actually get both ECC and RSA. "Pro" is just a branding by a particular vendor. – Steffen Ullrich Jul 27 '18 at 9:55
  • @JemmyLoveJenny You have that backwards wrt SHA1 and SHA256. SHA1 is weak to collisions, and has been phased out for most certificates. – AndrolGenhald Jul 27 '18 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.