1

I understand the basic nature of High Assurance Certificates. You pay more money for a certificate and the Certificate Authority investigates your company to a greater degree. After that occurs and they sign your certificate, then the Organization name appears in the URL for various modern browsers (Firefox, Google Chrome, Safari).

But let's say I want to create my own High Assurance Certificate Authority. (Let's say for a company intranet). Does anyone know any details on how this occurs? Do I simply have the text "High Assurance" in the Common Name for my CA?

What part of the certificate on the Root CA indicates that it is "High Assurance" or rather that the company has been investigated? Or is it part of the Root CA at all?

  • 1
    Is a high assurance certificate the same thing as an extended validation certificate? – Stephen Ostermiller Jul 9 '14 at 13:34
  • 1
    @StephenOstermiller While there's a lot of marketing hype, EV-SSL turns the address bar green while High Assurance certificates provide additional organization information. Browsers vary in how this is displayed. – jeffatrackaid Jul 9 '14 at 16:45
  • Why do you want a HA cert for internal use? The main point of an HA/EV cert is to show to someone that the organization is who it says it is -- which should not be a problem on an intranet. – jeffatrackaid Jul 9 '14 at 17:15
  • @jeffatrackaid I've been doing a little playing around with my own generated Root CA. It's mostly out of sheer curiosity. – Gordolio Jul 9 '14 at 18:16
  • Using our own CA root for internal is very common. I don't see the purpose of HA/EV certs internally because it is about identification and not security. HA certs afford no more encryption than standard ones. – jeffatrackaid Jul 10 '14 at 14:18
1

EV/High Assurance SSL certs use unique object IDs that are inserted into the extended policy field of the SSL certificate. Most applications (browsers) that support EV-SSL have this OID and CA fingerprint hard coded into them. When they get a successful match, the browser then displays the extended data.

You don't mention your usage case, but if this is for web browsers, you are likely stuck.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.