6 ms·
Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").
by alfredxing 11y ago
Let's Encrypt is also limited in that it issues Domain Validated certificates only. They aren't planning on issuing EV certificates (the "green address bar").
- UnoriginalGuy 11y agoThey couldn't possibly issue EV certificates without charging. The verification requirements are too high. You need actual staff to verify.
- itistoday2 11y agoEV certs are a total waste of money. Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar.
- aianus 11y ago> Pretty much everyone except maybe the site administrator won't notice and won't consider it a problem when a lock icon is shown instead of a green bar. I don't know if it's worth the money per se, but you can pin a couple of trusted CA root EV certs via HPKP and know it's much more difficult for someone to "accidentally" issue a valid cert for your site. If you do that, users won't see a lock instead of a green bar, they'll be blocked from accessing the site at all (if it's not their first visit and they're using a modern browser).
- jnbiche 11y agoYou can pin any certs via HPKP, including self-signed ones. The only security feature EV certs have over regular ones right now is the use of certificate transparency, but that should be extended to non-EV certs within 1-2 years.
- aianus 11y agoNo, the security feature is that if you only pin, say, Verisign EV root and Digicert EV root then an attacker would have to pass EV validation at those vendors. Which is much more difficult to do than to get any cert anywhere. You could pin your own cert, but that makes it difficult to rotate keys in a heartbleed type situation.
- vtlynch 11y agoWow, I never thought of that before! Though it would not protect from factoring because most EV roots are the same key length/hash. For anyone else reading, this works because the root programs give authority to issue EV certs separately from other certs. To keep the authority separate (most, perhaps all) CAs use separate roots for EVs.
- nailer 11y agoFirefox, Safari and Edge also use a grey lock for domain validation certificates.
- bandrami 11y agoProbably because EV certs are a stupid idea. Do you really know the difference between Citi Bank and Citibank? No? Then EV hasn't saved you from being phished.
- mike_hearn 11y agoEV certs are expensive because they have people in the loop, and so getting a cert for an obviously misleading name should be much harder. You'd have to pass an eyeballed sanity check.
- bandrami 11y agoYou have much greater faith in the CAs' probity and competence than I think is warranted.
- Gregordinary 11y agoWell, you can't just order an EV cert for "Citi Bank" unless you have "Citi Bank" registered as a legal entity. Section 9.2.1 (Page 9): https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf In addition to using & verifying the legally registered name, it must be verified that there is a physical address for the business, if that address doesn't match the registered location, additional verification is required. There are additional provisions of verification as well. See section 11 of the same document.
- bandrami 11y agoObviously the Citi example was a joke, but most actual certificates I see are to "R L Media Enterprises" or whatever the D&B name of the business is, which is opaque to me anyways.