-2

I am doing some pen test on my localhost I was wondering if I could find an EV certificate for localhost only. If you have an EV this is free just for localhost It will be find. I know EV is expensive but I was wondering if I ask Digicert, Comodo or Cloudflare if they have SSL for Pentest.

  • Why not use a self-signed certificate? Why do you need this certificate? – schroeder May 29 at 7:28
8

No. They do not have and they will not issue such certificate.

The CA/Browser Forum Baseline Requirements forbid to issue a certificate for a shared resource, such as localhost or a rfc 1918 IP.

Not to mention that an EV certificate would mean they thoroughly validated you were the owner of localhost, which you clearly aren't.

You can create your own CA certificate, import into your browser and sign with it any certificate you want to. However, if you want that to be treated as an EV certificate, that will be trickier, since only some roots are allowed to do that. You will need to recompile your browser.

Anyway, why do you want that certificate to be EV? It doesn't change a dime the technical security of the certificate. A pentesting would not be any difference from using an EV certificate or a DV one.

By the way, browsers are removing their EV indicators, so there is even less reason for you to want an EV certificate for localhost.

| improve this answer | |
3

There's no "free EV", "EV for localhost", nor commercial certificates for the localhost in the first place.

Also, there's no separate "SSL for Pentest"; if there was a service providing arbitrary certificates for everyone claiming they are penetration testers, the whole PKI would lost its credibility:

  • Claiming good intention doesn't rule out that the certificate won't be used for malicious purposes.
  • Even if the certificate was issued to some certified person, it's still technically possible to use it anywhere. Additionally, the private key could leak.
  • Nowadays everybody is claiming they are doing penetration testing, although they are not even aware of the basic information security concepts like this. This question is a proof of it.

The correct way is to create an own local certificate authority you can use on your laboratory environment and play with.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.