3 ms·
At least it could allow automating retrieving public information of the actual entity by whatever system checks the certification. Now, how to interact with the
by jgtrosh 9y ago
At least it could allow automating retrieving public information of the actual entity by whatever system checks the certification. Now, how to interact with the user to improve cognisance of the entity considered based on the newly available data is another problem.
- icebraining 9y agoThe certificate itself already automates the retrieval of public information. For example, Paypal's cert includes its full address, which has been verified by the CA: PayPal, Inc. # Street: 2211 N 1st St # Locality: San Jose # State: California # Postal Code: 95131-2021 # Registered: Delaware, US And we could include other information if we needed.
- tialaramex 9y agoIndeed for organisations that have one, the serial number field for the Subject (not to be confused with the serial number of the _certificate_) will be a unique number in some register of companies. In the UK you can mechanically turn those into a URL that gives you the (meagre) Companies House listing, there's no reason the same couldn't be true in the US. For PayPal this number is 3014267 and it'll be their registration number with the state of Delaware. The EV rules require a CA to figure out if there is such a number and if so fill it in on the certificate. If there is no number, they're supposed to write something else (a registration date maybe? I don't remember) (Sometimes a country has some companies that are so crazy old they pre-date the idea of registering companies, or turn out not to exist in their company register because the country created them by passing a law instead of formally registering them, or whatever, and these don't have serial numbers, e.g. I wouldn't be surprised if the Bank of England has no registered company number)