4

I am not saying I am actually going to buy one but I am wondering if an individual can get an Extended Validation SSL certificate?

I know this is intended for companies / organisations but would this technically be possible?

4

According to Section 7.1 of the Extended Verification Guidelines a certificate verifies the following:

(A) Legal Existence: The CA has confirmed with the Incorporating or Registration Agency in the Subject’s Jurisdiction of Incorporation or Registration that, as of the date the EV Certificate was issued, the Subject named in the EV Certificate legally exists as a valid organization or entity in the Jurisdiction of Incorporation or Registration;

Section 8.5

The CA MAY only issue EV Certificates to Applicants that meet the Private Organization, Government Entity, Business Entity and Non-Commercial Entity requirements specified below.

I believe the answer is no.

  • 1
    Section 8.5 of that document makes it even clearer. It lists the valid entities explicitly and an individual is not one of them. – AJ Henderson Aug 5 '14 at 14:53
  • @AJHenderson Here is a example of EV for individual : crt.sh/?id=15901870 – Shiji.J Oct 16 '16 at 21:38
  • 1
    @Shiji.jiang that is marked as a business. You can have a legal business that matches your name. That's probably the case here. It still is not issued to an individual. – AJ Henderson Oct 16 '16 at 22:28
  • 1
    @Shiji.Jiang - yes, I imagine you could do that, but point is that you must have a legal organization that has been verified by the CA to get extended validation. That is what the extended validation is all about. You can't get it simply being an individual, you need a company (which may just involve filing some paperwork depending on where you are.) – AJ Henderson Oct 19 '16 at 6:04
  • 1
    @AndreyFedorov - client certificates are something else entirely. We're talking specifically about EV server certificates which are a specific class of SSL certification for websites. You can also get Class 2 or Class 3 individual verified SSL certs as an individual. I actually have a Class 2 SSL cert personally which I use for my websites. The common name on them is my name and it was verified by checking my identifying documents and verifying who I am. EV by definition means the CA verified the legal entity's details, so you can't get one without having a legal entity to verify. – AJ Henderson Oct 19 '16 at 6:07
3

I believe this has recently changed. The latest Baseline Requirements, as of April 2015, include in Section 3.2.3:

If an Applicant subject to this Section 3.2.3 is a natural person, then the CA SHALL verify the Applicant’s name, Applicant’s address, and the authenticity of the certificate request.

The CA SHALL verify the Applicant’s name using a legible copy, which discernibly shows the Applicant’s face, of at least one currently valid government‐issued photo ID (passport, drivers license, military ID, national ID, or equivalent document type).The CA SHALL inspect the copy for any indication of alteration or falsification.

The CA SHALL verify the Applicant’s address using a form of identification that the CA determines to be reliable, such as a government ID, utility bill, or bank or credit card statement. The CA MAY rely on the same government‐issued ID that was used to verify the Applicant’s name.

The CA SHALL verify the certificate request with the Applicant using a Reliable Method of Communication.

I'm not able to find any CA's actually offering this yet, however.

  • 1
    All Baseline Requirements I've seen back to 1.1.3 in 2013 have this in 11.2.4; there is no 3.2.3. But Baseline documents don't control EV; the EV "Guidelines" (really requirements) documents link some sections of Baseline but not all and not this one; EV section 11 Verification is quite different from Baseline section 11, and does not have any case for natural person. – dave_thompson_085 Jul 21 '15 at 10:45
  • Ah, thanks for pointing that out, I'm not super familiar with these docs. Could you clarify who the Applicant in 3.2.3 refers to? Could it just be the agent performing the validation, not the entity being validated? – Andrey Fedorov Jul 21 '15 at 23:36
  • As I said there is no 3.2.3; Applicant is defined in Baseline Requirements 1.6.1 as "The natural person or Legal Entity that applies for (or seeks renewal of) a Certificate. ..." consistent with its meaning in ordinary language, i.e. someone who applies. The CABForum documents mention agents of the CA only in few places, and the Applicant is definitely not one of them. – dave_thompson_085 Jul 24 '15 at 21:37
  • Maybe I misunderstood. I think you said there is no 3.2.3 in the 2013 version. So the verification applies to the person submitting the application, not the entity being verified? – Andrey Fedorov Jul 26 '15 at 3:04
  • Here is a example of EV for individual : crt.sh/?id=15901870 – Shiji.J Oct 16 '16 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.