3 ms·
Browsers only trusted a limited number of roots for SGC. I wonder if any SGC certs actually were issued off "GTE CyberTrust Root" that expired in 2006.
by yuhong 11y ago
Browsers only trusted a limited number of roots for SGC. I wonder if any SGC certs actually were issued off "GTE CyberTrust Root" that expired in 2006.
- vtlynch 11y agoDo you know how to identify if a Root can issue SGC certs? I am seeing an OID (2.16.840.1.113730.4.1) in the EKU field for both End-Entity and Intermediate Certs from Thawte, but nothing on the Root. Was the ability to issue an SGC cert more of a policy thing than an actual flag in the cert? I BELIEVE that DigiCert used to issue certs with SGC if you specially requested it, but I cant find any sources on that at the moment.
- yuhong 11y agoIt was a list built into the browser. For IE/SChannel they hardcoded two roots (into RSABASE.DLL/RSAENH.DLL I think), the VeriSign Class 3 root and "Root SGC Authority". When they added new roots into IE 5.01/NT4 SP6/Win2000, they made some of them SGC capable by shipping cross certificates to this "Root SGC Authority" (you can still see them if you have a WinXP system). The reason Thawte SGC SuperCerts uses the VeriSign root now was that this particular cross certificate expired in 2004.