5

I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file:

enter image description here

How can I tell if it was signed with an extended validation (EV) code-signing certificate?

Say, the file above, being a Windows driver on a 64-bit Windows 10 has to have an EV signature to be able to load. So I can't seem to find anything in its properties that can indicate that it's an EV:

enter image description here

And since the OS can clearly tell the difference between EV and OV cert, how does it know?

Improve this question

1 Answer 1

Reset to default
1

The fact that it is an EV certificate appears in the certificate policy attribute that is shown in your image. The certificate policy identifies the rules under which the CA has issued them. In this case, it shows that digicert claims it was expended according to the policies with OIDs 2.16.8401.114412.3.1 and 2.23.140.1.4.1. Each CA assign its own OID to their different policies.

The client has a list of OIDs which it considers to be Extended Validation. Basically, while validating the certificate, it sees if the certificate was issued under a policy which it has listed on an internal list of policies that it considers to be Extended Validation (additionally, it verifies that the CA that signed such policy is the one that provides such policy).

As for checking it yourself, you could copy the code for deciding if it considers it EV validation from Chromium code, for instance. Although the policies that are considered EV may differ between Chromium and Windows, though.

Improve this answer
3
  • Thanks for the info. But I have so many questions about what you wrote there. 1) How do you know that those OIDs mean EV? 2) Are binary code signing certificates treated the same way as TLS certs? 3) Do you know where in Windows is that list of OIDs stored in, or which API does it use to determine that? 4) I have no idea where to find it in the Chromium source code. Thanks again.
    – c00000fd
    Sep 21, 2019 at 1:43
  • Each browser reviews the CA guidelines and decide if they consider that they meet what EV requisites. There's a CA/Browser Forum's EV OID (2.23.140.1.1), but it is not always used and even then, usually not trusted for that. See crbug.com/705285
    – Ángel
    Sep 22, 2019 at 16:32
  • Chromium documents that the list of EV roots and OID is hardcoded (although the trusted list of CA depends on the system) but it doesn't mention where is it hardcoded. I assume it will be somewhere inside (or pointed by) cs.chromium.org/chromium/src/net/cert, where the certificate validation code lives.
    – Ángel
    Sep 22, 2019 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .