5

Lets say I own a website say, citiibank.com. (extra i )Will certificate issuing authorities issue a https certificate to the site? For all they know it is a valid website, whose name just happens to be similar another website. Is there some validation of the credentials of the website before issuing certificates?
The context for asking this is from my typical usage of secure sites, I see the padlock and generally proceed.

  • If it's a well known Certificate Authority it will verify your identity in some way before issuing a certificate. I'm not sure if they will care about the name of the site or not. – RoraΖ Dec 18 '14 at 14:09
8

The short answer: if you own a domain you can get an certificate for that domain, period. It's similarity to another domain is irrelevant.

The bigger question seems to be "what sort of looking at an https page do I need to do to ensure it's really the page I think it is before entering my credentials".

The short answer to that is that you should look for the address bar to turn green, indicating an EV certificate (see below). You might consider additionally using something along the lines of the Perspectives project (site) which bypasses the CA system and it's vulnerabilities and provides an independent check.

There's some things about certificates you should know to better understand this answer:

There are in fact at least three different levels of https certificate (see here for example, and here for a more complete listing of certificate types):

  • Domain Validation (DV) certificates
  • Organizational Validation (OV) certificates
  • Extended Validation (EV) certificates

A DV certificate will show the padlock in your browser. When a CA issues a DV certificate, it is asserting that the person it got this certificate from is in control of the domain name in question. That is all. This can be certified, for example, by an email loop to, say, webmaster@domaininquestion.com, or by the CV requesting some random information be put on a specific page of that domain.

An OV certificate requires more checking than that, and an EV certificate requires even more checking. When issuing an EV certificate, the CA is asserting that the entity named in the certificate actually exists, and that someone at that company actually requested the certificate. Things like DUNS number for the company are looked up and checked.

An EV certificate usually turns the address bar green in some fashion. This gives you as much assurance as you can get from the CA system that the web server you're talking to is what you think it is (if any CA trusted by your browser has issued a fake certificate for that site you're still in trouble - hence the problem with the CA system).

Confusingly, OV certificates often do not have any special way to distinguish them from DV certificates. Sigh.

Note that the perspectives project is not fool-proof. I use it myself, and it consistently reports that google is being impersonated every time I connect. This is because google changes their certificates so rapidly and has so many of them, not because of an actual attack. Still, for many sites it provides a useful double check.

  • 1
    What's the difference between OV checking and EV checking? – cpast Dec 18 '14 at 20:33
  • EV and OV certify the same things: that the name of the organization on the cert is the actual name of the organization controlling the cert's private key. The difference is in how much effort is put into checking, and thus presumably how much trust can be given to that assertion, and thus the cost the entity had to pay the CA to get the certification. See here for more info (there's actually more kinds of certs!). – stochastic Dec 19 '14 at 1:45
3

It depends on the CA and on the type of certificate. Ordinary certificates are issued right after verifying that you control the domain in question; there is no further tracing (this is how, among other things, free StartSSL certificates are issued: they verify that you can receive mail to an address traditionally controlled by the system administrator). Some certificates involve issuing to a specific organization, and in that case they also follow up and make sure that you have an actual company with the name you claim. Likewise, if a human is involved in issuing the certificate, then they might get suspicious regardless of the type of certificate. However, because of how CAs work, you just need one to be willing to issue you a certificate, and StartSSL would do it. Don't trust HTTPS certificates to make sure you're at the right URL.

1

If you own a domain that is very similar to another you can still get your own SSL. It will be issued to you, as the owner, and not to the other entity. While I'm not sure citiibank.com is the best example, there are numerous similar sites out there due to the fact that common names are the domains of choice. If some guy named Bob owns bob.com and has an SSL there should be no reason why the owner of Bob's restaurant cannot also have an SSL on bobs.com.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.