4 ms·

Interestingly, Certificate Patrol warned me that the certificate at that site changed from a "Domain Validation" to an "Organization Validation" certificate fro

by cesarb 10y ago

Interestingly, Certificate Patrol warned me that the certificate at that site changed from a "Domain Validation" to an "Organization Validation" certificate from the same CA. Why did they do that change, and what would be the advantage for them of an OV instead of a DV certificate?

Someone1234 10y ago
OV are considered more secure than DV due to the higher registration requirements[0]. Additionally a DV certificate is good for a single domain, OV certificates are good for all of that organisation's domains. For example the NYT's certificate is valid for: DNS Name=nytimes.com DNS Name=*.blogs.nytimes.com DNS Name=*.blogs.stg.nytimes.com DNS Name=*.dev.nytimes.com DNS Name=*.nyt.com DNS Name=*.nytimes.com DNS Name=*.stg.nytimes.com This simplifies deployment significantly. [0] https://www.ssl.com/article/dv-ov-and-ev-certificates/ https://www.ssl.com/article/dv-ov-and-ev-certificates/
- hannob 10y ago
  > OV are considered more secure than DV due to the higher registration requirements[0] Nonsense. OV is no more secure than DV, just more expensive.
  - Klathmon 10y ago
    To be fair, it's more secure in the sense that someone who gets access to their domain name service can't generate their own OV cert without more access. They could however create their own DV cert. So while it uses the same technology, if you see an OC cert you can be more sure that it's the actual organization and not a cert that just proves that the domain is the domain.
    - konklone 10y ago
      But unless clients or humans do anything in response to the extra OV information, or in response to a lack of the extra OV information, that information has no security value. No browsers do anything with OV data unless humans manually take action to examine the certificate. So I'm comfortable saying they offer negligible security value.
      - kelnos 10y ago
        I think if a browser said "hey, this site used to have an OV cert, but now has a DV cert", and explained why that could be bad, that could be useful, though many non-technical users would probably not get the distinction. Sure, they don't do that now, but UI/UX around TLS has been improving a lot over the past few years. (Certificate Patrol's noting of the reverse is a little silly though; why would you flag a change that denotes an increase in security...?)
- vertex-four 10y ago
  DV certs can certainly have wildcards and multiple domains, and no, OV certs are not "more secure" - they simply contain additional fields which suggest that a CA has taken some amount of effort to verify that the domains belong to a given organisation, which the end user can read. This is generally more-or-less useless, as I'm pretty sure we all know that nytimes.com is owned by the New York Times.
  - dx034 10y ago
    And who reads the certificate anyway? I've never heard that an end user actually reads the content of the certificate. They just look for the green lock. It would often be confusing anyway, as the legal entities the certificate is issued to can be named very different from the brand.

by cesarb 10y ago

Someone1234 10y ago

OV are considered more secure than DV due to the higher registration requirements[0]. Additionally a DV certificate is good for a single domain, OV certificates are good for all of that organisation's domains. For example the NYT's certificate is valid for: DNS Name=nytimes.com DNS Name=*.blogs.nytimes.com DNS Name=*.blogs.stg.nytimes.com DNS Name=*.dev.nytimes.com DNS Name=*.nyt.com DNS Name=*.nytimes.com DNS Name=*.stg.nytimes.com This simplifies deployment significantly. [0] https://www.ssl.com/article/dv-ov-and-ev-certificates/ https://www.ssl.com/article/dv-ov-and-ev-certificates/

hannob 10y ago
> OV are considered more secure than DV due to the higher registration requirements[0] Nonsense. OV is no more secure than DV, just more expensive.
- Klathmon 10y ago
  To be fair, it's more secure in the sense that someone who gets access to their domain name service can't generate their own OV cert without more access. They could however create their own DV cert. So while it uses the same technology, if you see an OC cert you can be more sure that it's the actual organization and not a cert that just proves that the domain is the domain.
  - konklone 10y ago
    But unless clients or humans do anything in response to the extra OV information, or in response to a lack of the extra OV information, that information has no security value. No browsers do anything with OV data unless humans manually take action to examine the certificate. So I'm comfortable saying they offer negligible security value.
    - kelnos 10y ago
      I think if a browser said "hey, this site used to have an OV cert, but now has a DV cert", and explained why that could be bad, that could be useful, though many non-technical users would probably not get the distinction. Sure, they don't do that now, but UI/UX around TLS has been improving a lot over the past few years. (Certificate Patrol's noting of the reverse is a little silly though; why would you flag a change that denotes an increase in security...?)
vertex-four 10y ago
DV certs can certainly have wildcards and multiple domains, and no, OV certs are not "more secure" - they simply contain additional fields which suggest that a CA has taken some amount of effort to verify that the domains belong to a given organisation, which the end user can read. This is generally more-or-less useless, as I'm pretty sure we all know that nytimes.com is owned by the New York Times.
- dx034 10y ago
  And who reads the certificate anyway? I've never heard that an end user actually reads the content of the certificate. They just look for the green lock. It would often be confusing anyway, as the legal entities the certificate is issued to can be named very different from the brand.