Extended Validation Certificates (EV) [1] are a special type of X.509 certificate which require more extensive investigation of the requesting entity [2] by the Certificate Authority before being issued. The criteria for issuing EV certificates are defined by the Guidelines for Extended Validation Certificates. The guidelines are produced by the CA/Browser Forum, a voluntary organization whose members include leading CAs and vendors of Internet software, as well as representatives from the legal and audit professions.
Contents |
Motivation
An important motivation for using digital certificates with SSL was to add trust to online transactions by requiring website operators to undergo vetting with a certificate authority (CA) in order to get an SSL certificate. However, commercial pressures have led some CAs to introduce "domain validation only" SSL certificates for which minimal verification is performed of the details in the certificate. Most browsers' user interfaces do not clearly differentiate between low-validation certificates and those that have undergone more rigorous vetting. Since any successful SSL connection causes the padlock icon to appear, users are not likely to be aware of whether the website owner has been validated or not. As a result, fraudsters (including phishing websites) have started to use SSL to add credibility to their websites. By establishing stricter issuing criteria and requiring consistent application of those criteria by all participating CA's, EV SSL certificates are intended to restore confidence among users that a website operator is a legally established business with a public real-world presence.
Issuing criteria
Only CAs who pass an independent audit as part of their WebTrust (or equivalent) review may offer EV, and all CAs globally must follow the same detailed issuance requirements which aim to:
- Establish the legal identity as well as the operational and physical presence of website owner;
- Establish that the website owner has exclusive control over the URL; and
- Confirm the identity and authority of the individuals acting for the website owner, and that documents pertaining to legal obligations are signed by an authorised officer.
User experience
Browsers with EV support will display more information for EV certificates than for previous SSL certificates. Microsoft's Internet Explorer 7 is the first browser to be EV-ready. VeriSign has issued a controversial [3] add-on for Mozilla's Firefox browser to provide EV support for certificates issued by its CAs only. When they receive an EV certificate:
- The address bar will turn green.
- A special label will appear that periodically alternates between the name/summarised address of the website owner, and the CA that issued their certificate.
Firefox 3 and Opera have announced that they will provide EV support in future releases, although perhaps with different user interfaces. Until then, EV certificates will appear as a normal SSL padlock. The Extended Validation (EV) guidelines require participating Certificate Authorities to assign a specific EV identifer, which is registered with the browser vendors who support EV once the Certificate Authority has completed an independent audit and met other criteria. The browser matches the EV identifier in the SSL certificate with the one it has registered for the CA in question: if they match, and the certificate is verified as current, the SSL certificate receives the enhanced EV display in the browser's user interface.
Extended Validation certificate identification
EV certificates are standard x.509 digital certificates. The primary way to identify an EV certificate is by referencing the Certificate Policies extension field. Each issuer uses a different object identifier (OID) in this field to identify their EV certificates, and each OID is documented in the issuer's Certification Practice Statement.
| Issuer | OID | Certification Practice Statement |
|---|---|---|
| Comodo | 1.3.6.1.4.1.6449.1.2.1.5.1 | Comodo EV CPS, p. 28 |
| Cybertrust | 1.3.6.1.4.1.6334.1.100.1 | Cybertrust CPS v.5.2, p. 20 |
| DigiCert | 2.16.840.1.114412.2.1 | DigiCert EV CPS v. 1.0.1, p. 47 |
| Entrust | 2.16.840.1.114028.10.1.2 | Entrust EV CPS, p. 37 |
| GeoTrust | 1.3.6.1.4.1.14370.1.6 | GeoTrust EV CPS v. 2.6, p. 28 |
| GlobalSign | 1.3.6.1.4.1.4146.1.1 | [1], Version 5.4 onwards |
| Go Daddy | 2.16.840.1.114413.1.7.23.3 | Go Daddy EV CPS v. 2.0, p.42 |
| Network Solutions | 1.3.6.1.4.1.782.1.2.1.8.1 | Network Solutions EV CPS v. 1.1, 2.4.1 |
| QuoVadis | 1.3.6.1.4.1.8024.0.2.100.1.2 | QuoVadis Repository , p.33 |
| SecureTrust | 2.16.840.1.114404.1.1.2.4.1 | SecureTrust EV CPS v1.1.1, p.5 |
| Starfield Technologies | 2.16.840.1.114414.1.7.23.3 | Starfield EV CPS v. 2.0, p.42 |
| Thawte | 2.16.840.1.113733.1.7.48.1 | Thawte EV CPS v. 3.3, p.95 |
| VeriSign | 2.16.840.1.113733.1.7.23.6 | VeriSign EV CPS v. 3.3, p.87 |
Surrounding issues
Availability to Small Businesses
Since EV certificates are being promoted[4] and reported[5] as a mark of a trustworthy website, some small business owners have voiced concerns[6] that EV certificates give undue advantage toward large businesses. Much of this concern has been addressed over the course of 2007. The published drafts of the EV Guidelines excluded unincorporated business entities and early media reports[7] focused on that issue. Version 1.0 of the EV Guidelines were revised to embrace unincorporated associations as long as they were registered with a recognized agency, greatly expanding the number of organizations that qualified for an Extended Validation Certificate. Early media reports also focused on the higher price of EV certificates, typically pointing to VeriSign's pricing. While the higher validation costs inherent in following the EV Guidelines do engender higher prices relative to other SSL certificate products, a number of CA’s have been promoting EV prices below $500 [8] [9] [10].
Vulnerability to Phishing
There has been some concern that EV certificates, despite their improved authentication and higher cost, will not prevent phishing attacks[11]. In 2006, researchers at Stanford University and Microsoft conducted a usability study[12] of the EV display in Internet Explorer 7. The study measured users' ability to distinguish real sites from fraudulent sites when presented with various kinds of phishing attacks, and found that there was no significant difference between users who saw extended validation indicators and those who did not. Users who received training with the Internet Explorer 7 help file were more likely to judge all sites legitimate, regardless of whether they were fraudulent. Critics of this report[attribution needed] have said that the total sample size is inadequate for drawing useful conclusions about the studied subject matter. Each test cell had only nine subjects, resulting in a statistically significant variance of 45 (while the threshold for statistical significance in scientific studies is usually 5), considerably higher than the differences the paper seeks to report.
See also
- Transport Layer Security (SSL)
Footnotes
- ^ The term validation as used here should not be confused with the Certification path validation algorithm commonly found in a certificate context.
- ^ A requesting entity is the organization, company, government department or other person that is applying for a certificate.
- ^ McMillan, Robert. "Verisign plugin brings green address bars to Firefox", IDG News Service, May 18, 2007. "Because of this limitation, Verisign isn't recommending that nontechnical users download the plugin."
- ^ "in IE 7 ... if a website has an Entrust EV SSL Certificate installed, the address bar color will change to green and toggle between the identity of the site and the name of the certificate authority to let the consumer know they can shop with confidence." EV SSL Certificate FAQ. Entrust. Retrieved on 2007-02-05.
- ^ "The colored address bar, a new weapon in the fight against phishing scams, is meant as a sign that a site can be trusted, giving Web surfers the green light to carry out transactions there." IE 7 gives secure Web sites the green light. CNet. Retrieved on 2007-02-05.
- ^ Richmond, Riva. "Software to Spot 'Phishers' Irks Small Concerns", Wall Street Journal, December 19, 2006.
- ^ Richmond, Riva. "Software to Spot 'Phishers' Irks Small Concerns", Wall Street Journal, December 19, 2006.
- ^ Extended Validation SSL Certificates from DigiCert. DigiCert Security Services (November 2, 2007).
- ^ Extended Validation SSL Certificates from Entrust. Entrust, Inc (November 2, 2007).
- ^ SSL Certificate Services from GoDaddy!. GoDaddy.com Inc (November 2, 2007).
- ^ Schneier, Bruce. Microsoft Anti-Phishing and Small Business. Retrieved on 2007-02-05.
- ^ Jackson, Collin; Daniel R. Simon, Desney S. Tan, Adam Barth. "An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks". Usable Security 2007.
