How CA ensures that a certificate request is coming from me?

Question

To establish trusted SSL connection I need to create a certificate request. For example, if I use openSSL I can do it by the following command:

openssl req -new -key privkey.pem -out cert.csr

Anyone can do it. I wander how CA ensures that a certificate request is coming from me? Maybe somebody else create a certificate request on behalf of me. Maybe my mail to CA was hacked and a certificate request was replaced. Can I sign my certificate request and to send my signing public key to CA (e.g. in the separate mail)? In this case it is possible to ensure that a certificate request is coming from me.

Answer 1

Different CAs have different methods, and each CA has different methods based on what level of trust you are paying to have. (such as Extended Validation to get the green address bar)

The little fly-by-night CAs have a base level verification where you just give them an e-mail address and they send you an e-mail there, thereby validating that you really own the e-mail address associated with the certificate. These usually cost $15-$30, and are promoted as instant verification.

Standard CA validation involves providing a phone number for at least one contact at your company. The CA first looks up the phone number to verify that it belongs to the company the cert is registered to, then checks by calling and having the contact answer the phone and agree that they know of this cert request.

Higher level verifications involve faxing company documents (business license, registration, etc)

...so to keep it short, it depends on what kind of trust you pay for and which company is sticking their neck out for you.