4 ms·
Do you know how to identify if a Root can issue SGC certs? I am seeing an OID (2.16.840.1.113730.4.1) in the EKU field for both End-Entity and Intermediate Cer
by vtlynch 11y ago
Do you know how to identify if a Root can issue SGC certs?
I am seeing an OID (2.16.840.1.113730.4.1) in the EKU field for both End-Entity and Intermediate Certs from Thawte, but nothing on the Root.
Was the ability to issue an SGC cert more of a policy thing than an actual flag in the cert?
I BELIEVE that DigiCert used to issue certs with SGC if you specially requested it, but I cant find any sources on that at the moment.
- yuhong 11y agoIt was a list built into the browser. For IE/SChannel they hardcoded two roots (into RSABASE.DLL/RSAENH.DLL I think), the VeriSign Class 3 root and "Root SGC Authority". When they added new roots into IE 5.01/NT4 SP6/Win2000, they made some of them SGC capable by shipping cross certificates to this "Root SGC Authority" (you can still see them if you have a WinXP system). The reason Thawte SGC SuperCerts uses the VeriSign root now was that this particular cross certificate expired in 2004.