Why don't very many HTTPS/SSL websites supply identity information in their certs?

  • I think they do. All of the commercial SSL certificates issued by any of the major CAs will, at a minimum, include the domain name of the server. The domain name is exactly the identity information the HTTPS client has to verify. The HTTP client attempt to connect to a server with a specific DNS name. The SSL/TLS layer authenticates that the entity providing the content has been authenticated using that specific DNS name. – Henrick Hellström Feb 15 '15 at 9:35
  • I think CAs charge extra for identity verification and since browsers don't display it prominently (unlike extended validation), few site operators bother with it. – CodesInChaos Feb 15 '15 at 10:39

Ownership information requires an actual human to look at documentation submitted and verify that it's correct; you can't automate verifying a human-level concept like ownership. If a certificate needs a human to look at and manually approve it, that costs money. Since ownership information isn't something that's very visible to users except for EV certs, and most users don't care almost all of the time, there's no reason to spend the extra money for an ownership-verifying certificate.

(edit: It's not enough for the site to just put it in a cert: for ownership verification to be done in the cert, the CA has to verify the ownership themselves; no CA is willing to sign something claiming to be a person or company unless they verify that that's actually true).

  • What are EV certs? – Geremia Feb 16 '15 at 15:38
  • 1
    Extended Validation. Go to bofa.com and see the green bar saying "Bank of America" in the URL. That's an EV cert, which has extensive ownership verification and clearly displays it to the user. – cpast Feb 16 '15 at 15:43
  • Oh, yes, I was just reading the Wiki page on EVC. So, my question amounts to: "Why doesn't everyone use EV certs?" I think you've answered that. thanks – Geremia Feb 16 '15 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.