34

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ?

Can I create one myself and teach my browser to show it as EV?

35

The way that EV SSL certificates work is to stick an authority-specific OID in the certificate policies extension field of the cert (which is a standard X.509 certificate otherwise).

As EK said, the reference OIDs for each authority are shipped as part of the browser's root store of certificates. The user interfaces don't let you add a new CA and say "this is an EV capable CA and the UID is a.b.c.d.e.f".

I suppose it might be possible to build an open-source browser from source, adding your own CA's cert along with its EV oid to the root store, but you haven't really achieved much by doing so. The browser would no longer be compliant with the CA/Browser forum EV guidelines (which limit the EV-capable authorities).

Wikipedia has more info on EV certificates here:

http://en.wikipedia.org/wiki/Extended_Validation_Certificate

2

No you can't. The trusted roots for these are fixed within the browser

  • 3
    That just means you have to modify the browser. He specifically asked if he could "teach my browser to show it as EV". If it's FireFox or another browser whose source is available, then he can. – David Schwartz Aug 28 '11 at 8:37
  • 1
    While he did actually say 'can I teach my browser', only you seeing your own cert as EV is entirely pointless. So the aim of my answer was to be practical rather than pedantic. If you want to get really picky my answer is still correct because compiling a whole new browser from source is not teaching your existing browser. :P – JamesRyan Aug 30 '11 at 9:27
  • 5
    I do not agree that it is pointless. For example, in an organization it would be nice to put it on every browser to have all internal sites recognized. – some Aug 2 '14 at 14:04
  • Why would you need an EV certificate for that? Remember this doesn't cover all certs, you can still add a trusted root for non EV certificates. – JamesRyan Aug 2 '14 at 14:54
  • They are and they aren't. You can always import and remove certs from your trusted root certificate authority store. As a domain administrator for my organiation, I can push root certs to my managed users through policy so their browsers trust certificates that I generate for my internal servers. I too would like to know how to sign my internal certificates so that my users see "EV" level validation in their certificates. Wish someone could tell me what needs to be done to do that. – Erik Dec 2 '17 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.