4 ms·
The primary benefit I have found is for pinning/CA whitelisting purposes. All EV certs must have publicly searchable CT records, and go through reasonably comp
by BillinghamJ 9y ago
The primary benefit I have found is for pinning/CA whitelisting purposes.
All EV certs must have publicly searchable CT records, and go through reasonably complex validation processes involving some manual human validation processes, in addition to the usual checks.
This means that:
1. The barrier to getting an EV cert is higher - and the probability of a misissuance is lower.
2. If a misissuance does occur, it should be very easy to find out - by regularly/automatically searching CT logs.
If you choose two or three CAs whose EV programs you trust, you can pin against those CAs’ EV roots in your applications (e.g. a mobile app published by your company).
This is an effective process to reduce the risk of MITMs, and even continues to work as the CA changes intermediates etc (assuming they have separate roots for EV).
There isn’t a whole lot of benefit in browsers, unless you have preloaded pinned certificates there too (which many major sites do).
Also, as an aside, if anyone is looking for EV certs, I have always wholeheartedly recommended CertSimple. They’re very quick, aren’t too expensive, and have good support. The certs are issued by DigiCert. We use them for https://cuvva.com https://cuvva.com
- rocqua 9y agoSure, if I see an EV cert, I trust that cert slightly more. However, unless I expect an EV cert and happen to check, there is no downside to having a DV cert. If you are going to pin your apps to a CA, you have quite a few other options. For example, you could cross-sign all your certs by your own root CA cert and pin to that in addition to pinning to the other CA. At this point, you don't need to trust the CA as long as you trust your own root cert.
- BillinghamJ 9y agoI didn’t make any reference to any visual/user benefits/trust from EV certs. If you’re going to do cross-signing, then you do need to essentially operate your own root program - assuming you want to keep your own root secure. You’ll also then presumably need to serve an additional cert (or two, if you’re keeping your own root offline) in the intermediate chain so it can be validated by the client.
- Scott_Helme_ 9y agoIn April next year we will have the CT requirement for all certificates so EV will lose an edge there. For the pinning in a mobile app, would you still depend on the PKI or not just pin against your own private CA/certificates?
- BillinghamJ 9y agoOur mobile apps use the same endpoints/hostnames as our public API, so fairly important for it to be publicly trusted. I do still think the barrier to entry aspect of EVs will always be very helpful. In a world where you can get a DV cert in under a second (from LetsEncrypt), if your DNS or domain registration was to be compromised, you’d have no MITM protection at all until you managed to get it revoked - which is likely to take days. It’d almost be helpful to have a system where certs have to be requested (publicly on CT records) a week in advance or something, so issuance can be protested if something like the above did happen.