Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ?

Can I create one myself and teach my browser to show it as EV?

share|improve this question
    
You might take a look at this: blog.sidstamm.com/2009/04/roll-your-own-ev.html –  Nick Sep 28 '13 at 18:27

2 Answers 2

up vote 22 down vote accepted

The way that EV SSL certificates work is to stick an authority-specific OID in the certificate policies extension field of the cert (which is a standard X.509 certificate otherwise).

As EK said, the reference OIDs for each authority are shipped as part of the browser's root store of certificates. The user interfaces don't let you add a new CA and say "this is an EV capable CA and the UID is a.b.c.d.e.f".

I suppose it might be possible to build an open-source browser from source, adding your own CA's cert along with its EV oid to the root store, but you haven't really achieved much by doing so. The browser would no longer be compliant with the CA/Browser forum EV guidelines (which limit the EV-capable authorities).

Wikipedia has more info on EV certificates here:

http://en.wikipedia.org/wiki/Extended_Validation_Certificate

share|improve this answer
1  
Thanks for the clear explanation. –  Niels Basjes Jul 31 '09 at 6:14

No you can't. The trusted roots for these are fixed within the browser

share|improve this answer
2  
That just means you have to modify the browser. He specifically asked if he could "teach my browser to show it as EV". If it's FireFox or another browser whose source is available, then he can. –  David Schwartz Aug 28 '11 at 8:37
1  
While he did actually say 'can I teach my browser', only you seeing your own cert as EV is entirely pointless. So the aim of my answer was to be practical rather than pedantic. If you want to get really picky my answer is still correct because compiling a whole new browser from source is not teaching your existing browser. :P –  JamesRyan Aug 30 '11 at 9:27
    
I do not agree that it is pointless. For example, in an organization it would be nice to put it on every browser to have all internal sites recognized. –  some Aug 2 at 14:04
    
Why would you need an EV certificate for that? Remember this doesn't cover all certs, you can still add a trusted root for non EV certificates. –  JamesRyan Aug 2 at 14:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.