4

I want to download the certificate of a particular hostname and detect whether the CA used EV (extended validation) when issuing it. So far I was not able to find anything that identifies certificates as being EV. Is there any way to achieve this? Ideally using OpenSSL?

6

Note that EV certs are not structurally different -- they are just a cert issued under a different policy. So you have to check the policy. See http://en.wikipedia.org/wiki/Extended_Validation_Certificate#Extended_Validation_certificate_identification

You will need to do a fairly extensive table lookup, won't be native to openssl I'm afraid.

This is probably a dup of https://stackoverflow.com/questions/14705157/how-to-check-if-a-x509-certificate-has-extended-validation-switched-on

In response to some comments below:

This attribute is in the "X509v3 extensions" field. x509v3_config(5) notes

Certificate Policies.

This is a raw extension. All the fields of this extension can be set by using the appropriate syntax.

If you follow the PKIX recommendations and just using one OID then you just include the value of that OID. Multiple OIDs can be set separated by commas, for example:

certificatePolicies= 1.2.4.5, 1.1.3.4

That's how they get into the cert. Here is what it looks like in the cert: for example, if you examine the GlobalSign certificate protecting https://www.globalsign.com/en/ :

echo | openssl s_client -connect www.globalsign.com:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > globalsign.pem

This captures the certificate in a file. You can view it,

openssl x509 -text -noout -in globalsign.pem

and about midway through the output, [...]

       X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.4146.1.1
                  CPS: https://www.globalsign.com/repository/

[...] That policy OID corresponds to the EV OID for globalsign (and is on the table at wikipedia.). And as Mike points out, http://oid-info.com/get/1.3.6.1.4.1.4146.1.1 describes this as {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) 4146 certificate-policies(1) extended-Validation-SSL(1)} and that 4146 is GlobalSign NV/SA.

  • 1
    Alright. Thanks for that answer. However I tried that for example with the GlobalSign certificate (globalsign.com) and their policy identifier does not show up on the wiki site. Maybe it is sufficient to grab the OIDs from the chromium source code (chromium.googlesource.com/chromium/src/net/+/master/cert/…). – Coxer May 7 '15 at 15:37
  • An OID is a unique publicly-registered ID, therefore the OID database is public, for example, here's a site that will look up an OID for you: oid-info.com – Mike Ounsworth May 7 '15 at 15:47
  • Also is the field for the OID standardised or is it just somewhere in the certificate? – Coxer May 7 '15 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.