8

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require personal information? Or is there some other reason for the lack of privacy-friendly CAs?

I'd like to replace my personal web server's self-signed SSL certificate with a certificate signed by a well-trusted certificate authority. I understand that some use cases require thorough identity investigations, but I only need a basic domain validation (DV) certificate. I don't want to share personal details that are irrelevant to providing end-to-end encryption for personal use (e.g., my home address and phone number).

I'm not looking for a CA that blindly trusts a claim of ownership of a domain—I want them to have robust domain validation practices. I'm just looking for a CA that doesn't require information beyond proof of ownership of the domain.

Why should they care about my name or where I live as long as I can prove that I own the domain?

Do they want this information so that they can sue me if I do something "bad" with the cert they issue? Does the government force them to collect this information for law enforcement or foreign intelligence purposes?

Improve this question
6
  • There are X509 anonymity extensions. It's possible to contact CAs and ask if they support them. This concept is pretty contrary to the whole idea of CAs, and trust. I think this might be hard for you to find.
    – RoraΖ
    Commented Oct 6, 2014 at 15:49
  • @raz: Would the anonymity extensions conceal personal details from the CA, or just from people validating the signed cert? A DV cert already protects my identity from visitors to my site (only the domain name and an email address are in the cert); I'm interested in staying anonymous with the CA as well. I trust the CA to have good domain validation and private key protection practices, but I don't trust their ability to protect personal information.
    – Richard Hansen
    Commented Oct 6, 2014 at 16:38
  • See I think this whole idea is backwards. Asking a well-trusted CA to blindly trust a domain seems like bad practice to me. I mean I see where you're coming from, but at the same time I don't think there's a good way around it.
    – RoraΖ
    Commented Oct 6, 2014 at 16:41
  • @raz: See updated question.
    – Richard Hansen
    Commented Oct 6, 2014 at 16:56
  • @RichardHansen I understand your point, but how can they confirm that you own the domain if they don't confirm your identity?
    – RoraΖ
    Commented Oct 6, 2014 at 20:20

2 Answers 2

Reset to default
3

While there doesn't appear to be any existing privacy-friendly CA at this moment, all evidence suggests that the recently-announced Let's Encrypt CA (launching summer 2015) will not require users to provide personal information. This could change, but I doubt it will given EFF's involvement.

If Let's Encrypt will not collect any personal information when it launches, then that suggests that existing CAs do not fundamentally require your personal information, and that they ask for it simply because they can.

Improve this answer
1

The short answer is no, the Evidence of Identity (EOI) isn't mandatory, or forced upon them by governments (as least as far as I know) or Internet standards.

However consider that the CAs product is trust. People trust a CA to only issue certificates to the legal owners of trusted sites. EOI forms part of the chain of trust. A CA may be able to redesign certificate issuance processes to meet your particular needs, but the truth is that most people that require SSL certs don't care, especially as the owner is already identified in the whois record.

Incidentally the relevant standard here is RFC 3647, which covers Certificate Policy and the Certificate Practice Statement. While this RFC contains plenty of detail about the contents of these policies and supporting documents, it does not proscribe minimum levels of identification in the issuance process.

Improve this answer
2
  • EOI doesn't form a part of the chain of trust in DV certs—they (StartCom, Comodo) directly admit that they don't verify anything but control over the domain. So all they would need to do to redesign the certificate issuance process is to stop asking those irrelevant questions (or modify their terms to not require truthful answers).
    – Richard Hansen
    Commented Oct 10, 2014 at 1:29
  • 1
    For a DV certificate to be issued the CA has to check the right of the applicant to use a specific domain name. If they choose to do that by identifying the applicant then the EOI does form part of the chain of trust. I realise (and stated) that they could design this out if they chose to do so. I am not sure why StartCom would ask you for your personal details since their certificate policy states that all they need is a verification code that they send to preset addresses plus the one in the WHOIS record, except in the case where the domain may be misleading or potentially fraudulent.
    – DodgyG33za
    Commented Oct 10, 2014 at 2:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .