Recently I've been working on creating a self signed CA and had some success. Now I have a working CA with valid CRL server. The root CA has been deployed to all of my devices and had no problem.

But I have a question, I would like to sign SSL certs to display the green bar like other commercial EV SSL products. I looked into the parameters of those EV SSL certs but could not find any relevant variables. So I assume that the browsers have a separate way of knowing when to display the green bar.

I would like to know what it is and how to change it, especially for Firefox.


1 Answer 1


As stated by James F in an excellent answer at Server Fault:

The way that EV SSL certificates work is to stick an authority-specific OID in the certificate policies extension field of the cert (which is a standard X.509 certificate otherwise).

...the reference OIDs for each authority are shipped as part of the browser's root store of certificates. The user interfaces don't let you add a new CA and say "this is an EV capable CA and the UID is a.b.c.d.e.f".

I suppose it might be possible to build an open-source browser from source, adding your own CA's cert along with its EV oid to the root store, but you haven't really achieved much by doing so. The browser would no longer be compliant with the CA/Browser forum EV guidelines (which limit the EV-capable authorities).

Wikipedia has more info on EV certificates here: https://en.wikipedia.org/wiki/Extended_Validation_Certificate

Sure, this looks like a conspiracy by CAs (and browser devs). Yet, this arrangement makes for a less chaotic world.

NOTE: You can issue an EV cert with a green bar in Firefox, but you have to get a debugging build according to http://sidstamm.com/evssl-trust/firefox-evca.html

Getting others to trust your browser may be a bit difficult, though.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .