6

I want to download the certificate of a particular hostname and detect whether the CA used EV (extended validation) when issuing it. So far I was not able to find anything that identifies certificates as being EV. Is there any way to achieve this? Ideally using OpenSSL?

2 Answers 2

9

Note that EV certs are not structurally different — they are just a cert issued under a different policy. So you have to check the policy. (See EV certs on Wikipedia)

You will need to do a fairly extensive table lookup; it isn't native to openssl I'm afraid.

This is probably a duplicate of How to check if a X509 certificate has "Extended Validation" switched on?

In response to some comments below:

This attribute is in the "X509v3 extensions" field. x509v3_config(5) notes

Certificate Policies.

This is a raw extension. All the fields of this extension can be set by using the appropriate syntax.

If you follow the PKIX recommendations and just using one OID then you just include the value of that OID. Multiple OIDs can be set separated by commas, for example:

certificatePolicies= 1.2.4.5, 1.1.3.4

That's how they get into the cert. Here is what it looks like in the cert: for example, if you examine the GlobalSign certificate protecting https://www.globalsign.com/en/ :

echo | openssl s_client -connect www.globalsign.com:443 2>&1 | openssl x509 -noout -ext certificatePolicies

This will show something like:

X509v3 Certificate Policies:                                                                                                               
    Policy: 1.3.6.1.4.1.4146.1.1                                                                                                             
      CPS: https://www.globalsign.com/repository/                                                                                          

That policy OID corresponds to the EV OID for GlobalSign.

Then, if you visit http://oid-info.com/get/1.3.6.1.4.1.4146.1.1, it's described as

{iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) 4146 certificate-policies(1) extended-Validation-SSL(1)}

4
  • 2
    Alright. Thanks for that answer. However I tried that for example with the GlobalSign certificate (globalsign.com) and their policy identifier does not show up on the wiki site. Maybe it is sufficient to grab the OIDs from the chromium source code (chromium.googlesource.com/chromium/src/net/+/master/cert/…).
    – Coxer
    May 7, 2015 at 15:37
  • An OID is a unique publicly-registered ID, therefore the OID database is public, for example, here's a site that will look up an OID for you: oid-info.com May 7, 2015 at 15:47
  • Also is the field for the OID standardised or is it just somewhere in the certificate?
    – Coxer
    May 7, 2015 at 15:48
  • Excellent answer. With current openssl version (>= 1.1.1) instead of running openssl x509 -noout -text -in xxx.pem and manually searching through the output, you can run openssl x509 -noout -ext certificatePolicies -in xxx.pem to show only the certificate policies.
    – Max Truxa
    Oct 23, 2020 at 12:33
0

According to the Extended Validation certificate identification from Wikipedia:

EV certificates are standard X.509 digital certificates. The primary way to identify an EV certificate is by referencing the Certificate Policies extension field.

Each issuer uses a different object identifier (OID) in this field to identify their EV certificates, and each OID is documented in the issuer's Certification Practice Statement.

$ openssl s_client -connect www.globalsign.com:443 2>1 | \
> openssl x509 -noout -ext certificatePolicies
X509v3 Certificate Policies: 
    Policy: 1.3.6.1.4.1.4146.1.1
      CPS: https://www.globalsign.com/repository/
    Policy: 2.23.140.1.1
^C (interrupt)

In this example, the CP extension contains three qualifiers.

  • The Policy value of 1.3.6.1.4.1.4146.1.1, a GlobalSign legacy CP (OID), and the Policy value of 2.23.140.1.1, a CA/Browser Forum OID, both indicate that the certificate complies with an EV policy.

  • The CPS qualifier gives a pointer to the URI where the particular applicable CPS for the policy may be found.

Here is an another example about DigiCert:

$ openssl s_client -connect www.digicert.com:443 2>1 | \
> openssl x509 -noout -ext certificatePolicies
X509v3 Certificate Policies: 
    Policy: 2.16.840.1.114412.2.1
    Policy: 2.23.140.1.1
      CPS: http://www.digicert.com/CPS
^C (interrupt)

References:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .