Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just got a "Premium EV SSL Certificate" form GoDaddy.com. Apparently as of 8 months ago GoDaddy doesn't provide Class 3 Certificates. (http://support.godaddy.com/groups/go-daddy-customers/forum/topic/what-class-is-my-cert/) They also metntioned the use of certificates to be:

Class 1 for individuals, intended for email.

Class 2 for organizations, for which proof of identity is required.

Class 3 for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing certificate authority.

Class 4 for online business transactions between companies.

Class 5 for private organizations or governmental security

  1. Isn't EV certificate validation the same as a Class 3 validation? Why are EV certificates not just class 3?
  2. Do people use Class 4 Certificates? Technically we use our certificate for a B to B SOAP. Which would fall under Class 4. Is a class 4 really needed?
  3. Where is a list of CA's and the certificates that they issue?
  4. Since it boils down to encryption is there any major difference between certificates besides validation that you say you are who you are?
  5. What determines if a CA can give out Class 2 vs Class 3 and Class4 Certificates?

Thanks!

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

Marketing hype (and cost). This is not part of the spec. This is from Wikipedia:

http://en.wikipedia.org/wiki/Public_key_certificate

Vendor defined classes

VeriSign uses the concept of classes for different types of digital certificates [3]: Class 1 for individuals, intended for email. Class 2 for organizations, for which proof of identity is required. Class 3 for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing certificate authority. Class 4 for online business transactions between companies. Class 5 for private organizations or governmental security. Other vendors may choose to use different classes or no classes at all as this is not specified in the SSL protocol, though, most do opt to use classes in some form.

This is new(ish). They used to actually verify all requests to make sure you were who you said you were. This has gone by the wayside so you can get a cert in a few minutes instead of a few days.

share|improve this answer
    
So why is GoDaddy a "Go Daddy Class 2 Certification Authority"? Are there classes of Certificate Authorities? –  jneff Mar 2 '12 at 23:14
2  
@jneff: GoDaddy has a CA they call "GoDaddy Class 2 Certification Authority". They can name their internal CAs anything they want. They can call it "GoDaddy Class Asparagus CA" if they want. –  David Schwartz Mar 3 '12 at 3:27
add comment

Not quite. Most reputable Certificate vendors do all of that Class 3 checklist. An EV cert is just an extra thorough version of the same checks, and you can fail those checks for many more reasons that 'regular' ones.

share|improve this answer
add comment

Any "Certificate Class" value is purely marketing stuff. Technically, a "Certificate Authority" (CA) is just an almost regular SSL/TLS certificate in browser's Certificate Store. The "almost regular" part comes from the fact that these certificates do not include the extra extension flag that is embedded in pretty much every normal certificate:

Certificate Basic Constraints
  Critical
  Is not a Certificate Authority

Technically, any CA in your browser's Certificate Store any create additional CA certificates just by not including this extension in any certificate they sign and only CA policy can avoid that. An Extended Verification (EV) certificate is just additional extension flag that says

Certificate Policies
  Not Critical
  Extended Validation (EV) SSL Server Certificate

Notice the "Not Critical" status; any software is free to ignore this stuff.

I'd highly recommend watching talk by Moxie Marlinspike called "SSL And The Future Of Authenticity" given in Black Hat USA 2011: http://www.youtube.com/watch?v=Z7Wl2FW2TcA. it helps you to understand why the current CA system is very weak. I'd recommend purchasing any certificate that gets default warnings to go silent in your client software. If you want nicer badge in the browser UI, purchase any EV certificate. If and when you need more security, always check the certificate fingerprint by yourself; never trust any third party CA to do their stuff properly.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.