3 ms·
Is DigiCert able to provide SGC but they choose not to, or are they unable to do so?
by bjterry 11y ago
Is DigiCert able to provide SGC but they choose not to, or are they unable to do so?
- yuhong 11y agoBrowsers only trusted a limited number of roots for SGC. I wonder if any SGC certs actually were issued off "GTE CyberTrust Root" that expired in 2006.
- vtlynch 11y agoDo you know how to identify if a Root can issue SGC certs? I am seeing an OID (2.16.840.1.113730.4.1) in the EKU field for both End-Entity and Intermediate Certs from Thawte, but nothing on the Root. Was the ability to issue an SGC cert more of a policy thing than an actual flag in the cert? I BELIEVE that DigiCert used to issue certs with SGC if you specially requested it, but I cant find any sources on that at the moment.
- yuhong 11y agoIt was a list built into the browser. For IE/SChannel they hardcoded two roots (into RSABASE.DLL/RSAENH.DLL I think), the VeriSign Class 3 root and "Root SGC Authority". When they added new roots into IE 5.01/NT4 SP6/Win2000, they made some of them SGC capable by shipping cross certificates to this "Root SGC Authority" (you can still see them if you have a WinXP system). The reason Thawte SGC SuperCerts uses the VeriSign root now was that this particular cross certificate expired in 2004.
- nailer 11y agoI'm not sure re: Digicert, we (CertSimple) have an alternate certificate source that can provide SGC certificates, and choose not to.