Extended Validation SSL

[Sir Asvald]

Hello everyone, I always wondered. How do Extended Validation certs get validated? What is the process. Example how do CA issue it? For example. DigiCert or VeriSign. How do they issue. The OID for EV is 2.23.140.1.2.3. Is it possible for Internal CA or SubCA to issues these? I've got my own 2-Tier PKI in my network environment, I wanted to know if it's possible to issue EV Internally.

[Mbarton]

We're not allowed to talk about it...  

 

jk that's a good questions often times you see then not validated causing alerts 

[Mbarton]

3 minutes ago, Abdul201588 said:

I wanted to know if it's possible to issue EV Internally.

 

Yes, I believe so. I have had to something simmer to get some services back up. 

[Sir Asvald]

9 minutes ago, Mbarton said:

We're not allowed to talk about it...  

 

jk that's a good questions often times you see then not validated causing alerts 

I see.

8 minutes ago, Mbarton said:

Yes, I believe so. I have had to something simmer to get some services back up. 

Have you tried Issuing EV SSL internally?

[jj9987]

Extended validation certificates have specific OIDs, which are hardcoded into browsers' trust stores (and can't be changed after compiling) and identify, which organization issued the certificate. These can be changed only if you request browser's developer team to start accepting your OID in EV certs, which is pretty much impossible unless you are known good certificate issuer and get approved (and this process is massive, even becoming a trusted CA is costly in terms of money and time).

 

You could build your own browser from source, adding your own CA's cert along with its EV OID to the root store, but how much will it really help?

 

Here is the code from Firefox - https://hg.mozilla.org/mozilla-central/file/0d72c7996d60/security/certverifier/ExtendedValidation.cpp

 

If you are looking to improve your internal traffic to get that green identity showing - don't bother, Chrome will stop doing it soon.

[Sir Asvald]

26 minutes ago, jj9987 said:

Extended validation certificates have specific OIDs, which are hardcoded into browsers' trust stores (and can't be changed after compiling) and identify, which organization issued the certificate. These can be changed only if you request browser's developer team to start accepting your OID in EV certs, which is pretty much impossible unless you are known good certificate issuer and get approved (and this process is massive, even becoming a trusted CA is costly in terms of money and time).

 

You could build your own browser from source, adding your own CA's cert along with its EV OID to the root store, but how much will it really help?

 

If you are looking to improve your internal traffic to get that green identity showing - don't bother, Chrome will stop doing it soon.

Yeah. I Know about OIDs, I actually got one from here http://pen.iana.org/pen/app

 

28 minutes ago, jj9987 said:

If you are looking to improve your internal traffic to get that green identity showing - don't bother, Chrome will stop doing it soon.

I don't use Chrome for my internal SSL. Mostly because half my Web applications only works with Firefox, Edge and I believe opera. 

[Mikensan]

Honestly other than for fun I don't see a reason to create a EV cert. Users barely pay attention to the status of a website, half the time just clicking "continue" even when there's a problem.

 

However pretty sure all you have to do is properly create the certificate and make sure the client machines trust your CA. Firefox has its own internal certificate store, but you can configure it to use the windows store. IE and Chrome use the windows store natively. You don't have to compile your own browser.......... Sort of an absurd thought.

 

Quick google search:

https://blogs.technet.microsoft.com/askds/2009/08/14/extended-validation-support-for-websites-using-internal-certificates/

 

[Sir Asvald]

11 hours ago, Mikensan said:

Honestly other than for fun I don't see a reason to create a EV cert. Users barely pay attention to the status of a website, half the time just clicking "continue" even when there's a problem.

 

However pretty sure all you have to do is properly create the certificate and make sure the client machines trust your CA. Firefox has its own internal certificate store, but you can configure it to use the windows store. IE and Chrome use the windows store natively. You don't have to compile your own browser.......... Sort of an absurd thought.

 

Quick google search:

https://blogs.technet.microsoft.com/askds/2009/08/14/extended-validation-support-for-websites-using-internal-certificates/

 

I've tried that method, Doesn't work for me.