9

Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't.

Screenshots of the URL bar for secure websites in Safari

What's the difference between a certificate that identifies a corporation and one that doesn't? Shouldn't they pretty much all identify the owner of the site?

Improve this question

2 Answers 2

Reset to default
14

Certificates that identify the owner of the site are Extended Validation certificates. They require certificate authorities to check the owner identity, and are as such more expensive than certificates that don't.

A normal certificate only ensures that the website you are talking to is indeed the domain you tried to contact.

Improve this answer
1
5

An ordinary certificate:

  • Confirms that the possessor of the certificate owns the domain that is displaying it.
  • Serves as the public-private key combination for encrypting traffic.
  • Is issued by a Certificate Root Authority (CA) OR an entity that has been granted subordinate status to a root CA.
  • Users can override protections: If you navigate to an HTTPS site and your browser cannot verify the certificate (perhaps because it is a self-signed certificate), you have the chance to continue and instruct your browser to trust it anyway.

An Extended Validation (EV) certificate (when used with an EV aware client):

  • Subject to stricter verification requirements to prove the identity of the holder and the holder's connection to the domain name. These requirements are detailed in pubished guidelines, especially Section 11, Verification Requirements.
  • Is embedded in the browser by the browser vendor.
  • Limited by how long they are valid. Maximum is two years. Holders must go through verification process again after time limit.
  • No wildcards allowed.
  • The ordinary user cannot add these to the list of trusted certificates in the browser (so, not possible to self-sign these).
  • Like user2313067 said, they are more expensive.
Improve this answer
5
  • What do you mean with "embedded in the browser"? It seems unrealistic to me to ship a browser with all the EV certificates included.
    – zneak
    Dec 8, 2013 at 23:24
  • I meant that a browser ships with a list of trusted certificates (the public keys, anyway) and these are updated as needed. EV certificates are updated as well, but the ordinary user cannot access these, so I said "embedded".
    – mcgyver5
    Dec 9, 2013 at 1:45
  • It's still not entirely clear to me what you mean: are you talking about the root certificates for EV certificates?
    – zneak
    Dec 9, 2013 at 1:46
  • 1
    sorry - browsers ship with a list of ordinary root and subordinate certificates and can be updated. It is the same with EVs but they don't let the user or "anyone else" change what is trusted. That means self-signed certificates and that means if a web site is spoofed somehow, you can't bypass the browser warning about a certificate mismatch. I don't know the exact mechanism by which the browser protects and updates the EV certificates. I agree that it is unrealistic that they would be hard coded in a browser so "embed" is perhaps a non-exact word.
    – mcgyver5
    Dec 9, 2013 at 3:08
  • From Wikipedia: "The Extended Validation guidelines require participating certificate authorities to assign a specific EV identifier, which is registered with the browser vendors who support EV once the certificate authority has completed an independent audit and met other criteria. The browser matches the EV identifier in the certificate with the one it has registered for the CA in question: if they match, and the certificate is verified as current, the certificate receives the enhanced EV display in the browser's user interface."
    – mcgyver5
    Jun 6, 2016 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .