6 ms·

What are some trustable providers of EV certificates? LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, wh

What are some trustable providers of EV certificates? LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? What's an easy way to check if a provider (for instance Gandi, who I use for my domains) is going to be culled by this? In fact, I don't even seem to able to find certificate information in Chrome any more - clicking on the padlock just gives me a bunch of settings and "Learn more" which is some annoying page. Edit: It's in Developer Tools under "Security"

driverdan 9y ago
> I'm a company that needs to show the company name next to the padlock Does anyone actually look at or care about that?
- cpncrunch 9y ago
  Yes, everyone who cares about their security when using online banking.
- rocqua 9y ago
  See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-certificate/ https://www.troyhunt.com/journey-to-an-extended-validation-c...
  - snuxoll 9y ago
    It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.
    - ori_b 9y ago
      > Nobody notices the lack of EV on amazon.com, because, well, it's Amazon. Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.
      - Ermenwyr 9y ago
        amazoone.com actually redirects to www.amazon.com, as do amazoon.com, aamazon.com, and amezon.com. It seems like finding a domain name that is "close" to amazon.com that is not already registered by Amazon is not that easy.
  - tonyztan 9y ago
    We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.
    - duskwuff 9y ago
      > We need an 'Expect-EV' header, just like 'Expect-CT'. What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it. > Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses. Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)
      - tonyztan 9y ago
        > What good would that header do? It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful. >EV certificates are not available to everyone. I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable. >how do you enforce a requirement like that If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.
- reificator 9y ago
  Marketing often cares about that a lot. Users seem to notice but often times there's confusion as to why the address bar is, for lack of a better term, stuttering. And god help you if your certificate uses a name you don't have any branding for.
  - walshemj 9y ago
    Exactly for example the fiasco of behringer whose site is get this "www.music-group.com". It always seem to be German firms that don't just get the internet at all
- nothrabannosir 9y ago
  I definitely do for my bank. And the country code that is shown next to it.
- Twirrim 9y ago
  >Does anyone actually look at or care about that? No. You'll note that Amazon doesn't. They spent a bunch of time trying to figure out if it made a difference for customers. It turns out it doesn't, so they don't bother with the extra expense.
  - nailer 9y ago
    Apple does, as a counterpoint. I'm interested in the Amazon study if you have a link, I haven't seen that before. (Note, I run CertSimple and we specialise in making the verification process for EV faster and much less painful, so I'm biased)
    - Twirrim 9y ago
      I don't have any link... but off the top of my head they found that such a tiny percentage of people actually noticed the EV, even amongst technical people, that the value added was negligible. Even those that notice the EV certificate indicated that it didn't change their decision to purchase from a site. You can make the EV process as smooth and simple as you like, but unless there's good solid business value provided by it (in $$s terms), you've got way more of an uphill struggle ahead.
  - wongarsu 9y ago
    For someone as big as Amazon, isn't it cheaper to just get an EV cert than spending significant time figuring out whether it's worth it?
    - greenleafjacob 9y ago
      Not if it increases conversation rate by X%.
      - sambe 9y ago
        That would only reinforce the point.
- nailer 9y ago
  It's proof of identity, matching a pubkey to a legal name. Debian does it, Windows does it, your university does it, keybase does it. HTTPS is one of the few areas where it (since DV was invented) no longer the common practice. Note: I'm biased. See bio.
- walshemj 9y ago
  if I am logging onto a bank or my broker Abso-fragging-lutely, damn it :-)
snuxoll 9y ago
Generally a quick google answers the question as well, Gandi lists their partnership with Comodo on their EV certificate ("SSL business") page [1] as well as a coule places on their wiki. So yes, if you're using Gandi (and I still do myself for things LetsEncrypt cannot be used for, namely things where frequent rotation requires time-consuming manual intervention) you are safe from Symantec's distrust. [1] https://v4.gandi.net/ssl/business https://v4.gandi.net/ssl/business
gerdesj 9y ago
You will need an Extended Validation (EV) certificate to get your name in the bar. To get it to go green you "only" need a Domain Validation (DV) certificate. In simple terms: DV proves you own your DNS domain and EV proves that your real world entity owns the DNS domain. Lets Encrypt will only do DV and quite right too. EV costs a far bit more because it should require some proper checks - for example checking Company's House in the UK for a Limited Company's details and matching them up against real people. You can set a flag in Chrom{ium!e} that will put a link to the cert in the menu that drops down when you click on the green bit, saving you a trip to dev tools. Go to chrome://flags and search for "Show certificate link". Don't know why it isn't the default.
- antihero 9y ago
  Yeah I figured that EV is out of scope for LetsEncrypt. Thanks for the tip about the flags!
- realityexists 9y ago
  > Go to chrome://flags and search for "Show certificate link". Don't know why it isn't the default. Thanks for this tip! I like to check the certificate, so this will save me some clicks. I also don't know why it's not enabled by default.
BillinghamJ 9y ago
https://certsimple.com https://certsimple.com It’s incredibly fast, the guy who runs it is nice, great customer service. It just does what you need.
- nailer 9y ago
  Thanks James! Mike from CertSimple here. HN folk can give me a shout anytime (mike@certsimple.com) or ask here - it's midnight in the UK but I'll be back up in the morn!
  - nodesocket 9y ago
    I believe that EV certificates cannot be wildcard certs, is this still true?
    - detaro 9y ago
      yes.
    - nailer 9y ago
      Yep, what @detaro said. Here's the specifics: https://certsimple.com/blog/wildcard-ev-certificate https://certsimple.com/blog/wildcard-ev-certificate
      - darklajid 9y ago
        Like the site, but the example seems off. It talks about 'bankofamerica.com.fraud.ru' in the first paragraph, but then discusses how 'fraud.ph' (why did we change TLDs? This should stick to ru or the above should be changed to ph) gets a wildcard cert for '* .com.fraud.com' (we changed TLDs again, to com this time. I assume we're talking about 'fraud.ph' getting a cert for * .com.fraud.ph - or .. we stick with ru)
        nailer 9y ago
        Good point - I was experiencing a bunch of fraud from the Phillippines and thought the Russian example was too cliched. I'll tweak the example to be more consistent.
hannob 9y ago
> LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? Sorry, what's a company that needs to show the company name beside the padlock? (Except maybe: Company that has too much money to spend on pointless "premium" security services without any shown benefit.)
- samtho 9y ago
  EV is an option for companies that worry about branding - specifically ones that are well-known to do business offline. This extra layer of trust, relayed to the user from the web browser, reinforces the fact that they are on the correct website. For example, I can go grab something like "bannk.com" (notice two 'n's) and get a DV cert for it - because I hypothetically own that name. Now, I can copy the real "bank.com" onto the site and perform a phishing attack. They both appear to be encrypted but the EV'd one has the organization noted, the fake one will not be able to have that legitimacy. I am not saying the system isn't without its faults (people might not even notice), but it's an extra measure a company can do to keep itself distinguished from phshing websites or copycat services.
  - mnx 9y ago
    Too many negatives in that last sentence.
- Normal_gaussian 9y ago
  > without any shown benefit on the contrary, I know that the presence of an EV line has helped my mother avoid a pretty decent phishing attempt. Any company holding confidential details or data should have one, its just a shame they are so expensive (which due to their verification is unlikely to come down too far).
TheAceOfHearts 9y ago
I'm unfamiliar with the problem space. What are some of the use-cases for EV certificates? It looks like lots of big name sites don't use them. Why do some companies feel they need it, while letting internet giants such as Facebook, Google, Microsoft, etc. get away without it?
- stephenr 9y ago
  EV shows (in the address bar and in the cert details) the legal entity that the certificate is for. Eg anyone could register "bankofanerica.com" and get a DV cert issued for it. Only Bank of America can get a cert that shows their legal/trading company name. Well, that's the idea. I'm not aware of any ev misissuance but I don't follow this stuff like a hawk either.
jlgaddis 9y ago
Starting w/ version 60, go to chrome://flags/#show-cert-link, click "Enable", and restart your browser. Ta-da!

driverdan 9y ago

> I'm a company that needs to show the company name next to the padlock Does anyone actually look at or care about that?

cpncrunch 9y ago
Yes, everyone who cares about their security when using online banking.
rocqua 9y ago
See here [1] for a pretty good write-up arguing EV isn't worth much. One issue is that it only has value if you would notice it is missing. Would you trust a paypal site that just had the green padlock, but not the name? Do you think your parents would? [1] https://www.troyhunt.com/journey-to-an-extended-validation-certificate/ https://www.troyhunt.com/journey-to-an-extended-validation-c...
- snuxoll 9y ago
  It's useful for no-name companies, an EV certificate highlights a company that went through unnecessary pain just to get a little green checkbox - I know I personally trust smaller online retailers more when they have one since they've had to prove their identity to a CA. Nobody notices the lack of EV on amazon.com, because, well, it's Amazon.
  - ori_b 9y ago
    > Nobody notices the lack of EV on amazon.com, because, well, it's Amazon. Which means that nobody notices the lack of EV on amazoone.com, because, well, it'as Amazon.
    - Ermenwyr 9y ago
      amazoone.com actually redirects to www.amazon.com, as do amazoon.com, aamazon.com, and amezon.com. It seems like finding a domain name that is "close" to amazon.com that is not already registered by Amazon is not that easy.
- tonyztan 9y ago
  We need an 'Expect-EV' header, just like 'Expect-CT'. Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV is more expensive and onerous but it has the potential to thwart phishing.
  - duskwuff 9y ago
    > We need an 'Expect-EV' header, just like 'Expect-CT'. What good would that header do? A phishing site (say, "paypaaaaal.com") would simply not set it. > Or maybe all websites that request certain info (like SSN or credit card) should be required to have EV. EV certificates are not available to everyone. In particular, they're only available to users in certain countries, and even then only to registered businesses. Besides, how do you enforce a requirement like that, short of barring users from submitting data that looks like a credit card to a site without an EV certificate? (Which would cause massive and entirely justified outrage, and would be quickly bypassed by phishing sites regardless.)
    - tonyztan 9y ago
      > What good would that header do? It would protect against MitM attacks where the attacker has fraudulently obtained a non-EV certificate, such as through CA compromise or a BGP attack, especially since EV certs are required to have CT log entries. I guess since Expect-CT already solves this, Expect-EV may not be that helpful. >EV certificates are not available to everyone. I agree this is a problem. EV should be available to anyone anywhere willing and able to prove their legal identity, be it a person or an organization. Then if someone uses EV to phish, they can be held accountable. >how do you enforce a requirement like that If this becomes standard, then we can train users to expect EV indicators when asked for payment data. Any site asking for it without EV would automatically become out-of-the-norm.
reificator 9y ago
Marketing often cares about that a lot. Users seem to notice but often times there's confusion as to why the address bar is, for lack of a better term, stuttering. And god help you if your certificate uses a name you don't have any branding for.
- walshemj 9y ago
  Exactly for example the fiasco of behringer whose site is get this "www.music-group.com". It always seem to be German firms that don't just get the internet at all
nothrabannosir 9y ago
I definitely do for my bank. And the country code that is shown next to it.
Twirrim 9y ago
>Does anyone actually look at or care about that? No. You'll note that Amazon doesn't. They spent a bunch of time trying to figure out if it made a difference for customers. It turns out it doesn't, so they don't bother with the extra expense.
- nailer 9y ago
  Apple does, as a counterpoint. I'm interested in the Amazon study if you have a link, I haven't seen that before. (Note, I run CertSimple and we specialise in making the verification process for EV faster and much less painful, so I'm biased)
  - Twirrim 9y ago
    I don't have any link... but off the top of my head they found that such a tiny percentage of people actually noticed the EV, even amongst technical people, that the value added was negligible. Even those that notice the EV certificate indicated that it didn't change their decision to purchase from a site. You can make the EV process as smooth and simple as you like, but unless there's good solid business value provided by it (in $$s terms), you've got way more of an uphill struggle ahead.
- wongarsu 9y ago
  For someone as big as Amazon, isn't it cheaper to just get an EV cert than spending significant time figuring out whether it's worth it?
  - greenleafjacob 9y ago
    Not if it increases conversation rate by X%.
    - sambe 9y ago
      That would only reinforce the point.
nailer 9y ago
It's proof of identity, matching a pubkey to a legal name. Debian does it, Windows does it, your university does it, keybase does it. HTTPS is one of the few areas where it (since DV was invented) no longer the common practice. Note: I'm biased. See bio.
walshemj 9y ago
if I am logging onto a bank or my broker Abso-fragging-lutely, damn it :-)

snuxoll 9y ago

Generally a quick google answers the question as well, Gandi lists their partnership with Comodo on their EV certificate ("SSL business") page [1] as well as a coule places on their wiki. So yes, if you're using Gandi (and I still do myself for things LetsEncrypt cannot be used for, namely things where frequent rotation requires time-consuming manual intervention) you are safe from Symantec's distrust. [1] https://v4.gandi.net/ssl/business https://v4.gandi.net/ssl/business

gerdesj 9y ago

You will need an Extended Validation (EV) certificate to get your name in the bar. To get it to go green you "only" need a Domain Validation (DV) certificate. In simple terms: DV proves you own your DNS domain and EV proves that your real world entity owns the DNS domain. Lets Encrypt will only do DV and quite right too. EV costs a far bit more because it should require some proper checks - for example checking Company's House in the UK for a Limited Company's details and matching them up against real people. You can set a flag in Chrom{ium!e} that will put a link to the cert in the menu that drops down when you click on the green bit, saving you a trip to dev tools. Go to chrome://flags and search for "Show certificate link". Don't know why it isn't the default.

antihero 9y ago
Yeah I figured that EV is out of scope for LetsEncrypt. Thanks for the tip about the flags!
realityexists 9y ago
> Go to chrome://flags and search for "Show certificate link". Don't know why it isn't the default. Thanks for this tip! I like to check the certificate, so this will save me some clicks. I also don't know why it's not enabled by default.

BillinghamJ 9y ago

https://certsimple.com https://certsimple.com It’s incredibly fast, the guy who runs it is nice, great customer service. It just does what you need.

nailer 9y ago
Thanks James! Mike from CertSimple here. HN folk can give me a shout anytime (mike@certsimple.com) or ask here - it's midnight in the UK but I'll be back up in the morn!
- nodesocket 9y ago
  I believe that EV certificates cannot be wildcard certs, is this still true?
  - detaro 9y ago
    yes.
  - nailer 9y ago
    Yep, what @detaro said. Here's the specifics: https://certsimple.com/blog/wildcard-ev-certificate https://certsimple.com/blog/wildcard-ev-certificate
    - darklajid 9y ago
      Like the site, but the example seems off. It talks about 'bankofamerica.com.fraud.ru' in the first paragraph, but then discusses how 'fraud.ph' (why did we change TLDs? This should stick to ru or the above should be changed to ph) gets a wildcard cert for '* .com.fraud.com' (we changed TLDs again, to com this time. I assume we're talking about 'fraud.ph' getting a cert for * .com.fraud.ph - or .. we stick with ru)
      - nailer 9y ago
        Good point - I was experiencing a bunch of fraud from the Phillippines and thought the Russian example was too cliched. I'll tweak the example to be more consistent.

hannob 9y ago

> LetsEncrypt is wonderful, but if I'm a company that needs to show the company name next to the padlock, who should I be using? Sorry, what's a company that needs to show the company name beside the padlock? (Except maybe: Company that has too much money to spend on pointless "premium" security services without any shown benefit.)

samtho 9y ago
EV is an option for companies that worry about branding - specifically ones that are well-known to do business offline. This extra layer of trust, relayed to the user from the web browser, reinforces the fact that they are on the correct website. For example, I can go grab something like "bannk.com" (notice two 'n's) and get a DV cert for it - because I hypothetically own that name. Now, I can copy the real "bank.com" onto the site and perform a phishing attack. They both appear to be encrypted but the EV'd one has the organization noted, the fake one will not be able to have that legitimacy. I am not saying the system isn't without its faults (people might not even notice), but it's an extra measure a company can do to keep itself distinguished from phshing websites or copycat services.
- mnx 9y ago
  Too many negatives in that last sentence.
Normal_gaussian 9y ago
> without any shown benefit on the contrary, I know that the presence of an EV line has helped my mother avoid a pretty decent phishing attempt. Any company holding confidential details or data should have one, its just a shame they are so expensive (which due to their verification is unlikely to come down too far).

TheAceOfHearts 9y ago

I'm unfamiliar with the problem space. What are some of the use-cases for EV certificates? It looks like lots of big name sites don't use them. Why do some companies feel they need it, while letting internet giants such as Facebook, Google, Microsoft, etc. get away without it?

stephenr 9y ago
EV shows (in the address bar and in the cert details) the legal entity that the certificate is for. Eg anyone could register "bankofanerica.com" and get a DV cert issued for it. Only Bank of America can get a cert that shows their legal/trading company name. Well, that's the idea. I'm not aware of any ev misissuance but I don't follow this stuff like a hawk either.

jlgaddis 9y ago

Starting w/ version 60, go to chrome://flags/#show-cert-link, click "Enable", and restart your browser. Ta-da!