2

It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.

2
  • Hello, it would be great if you could elaborate more on your use case scenario and the exact issue you are facing. This would help the community provide you with a more objective answer.
    – Shurmajee
    Commented Jun 5, 2020 at 6:51
  • They are completely different things and cannot be compared. Extended validation is about the process used to verify the identity of the requester. Certificate pinning is about tying a host to a specific certificate or public key.
    – Marc
    Commented Jun 5, 2020 at 7:09

1 Answer 1

4

It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.

EV certificates do not offer better protection than pinning but worse.

With pinning the client expects a specific certificate, or a specific public key or a specific CA, depending on what exactly was pinned. Without pinning instead the client will accept any certificate issued by a locally trusted CA, no matter if EV or not. The client does not know that the the original site would use a EV certificate and not simpler DV certificate and thus cannot expect an EV certificate. Thus without pinning it is sufficient for an attacker to compromise any of the public CA, no matter if EV was used or not.

One might then ask why not use pinning everywhere instead of relying on some brittle PKI with the trust in CA's? Simply because pinning requires that all clients need to know the certificate or key of the server before connecting to the server in order to verify it. These keys have to be propagated to the clients in a secure and reliable way and need to be updated whenever a certificate or key changes. This simply does not scale well. A PKI instead scales much better since only the trusted root CA need to be propagated and these rarely change.

3
  • EV is a bit dead and buried. Over time it lost importance and people lost trust in CAs. Even browsers aren't highlighting EV as they once did. Conversely things like letsencrypt which are at the least corporate end of the scale have had an immense gain in popularity. Each to their own I suppose.
    – Pedro
    Commented Jun 5, 2020 at 9:51
  • Thanks for the replies. I now understand the difference. Commented Jun 5, 2020 at 12:36
  • @MelvinBriggs you should accept this answer if it sufficiently answers your question.
    – john doe
    Commented Jun 5, 2020 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .