35

I can create by own CA and generate a self signed SSL certificate this way. But what does it take to make the browser show the certificate as being an "Extended Validation SSL certificate" ?

Can I create one myself and teach my browser to show it as EV?

Improve this question
1

2 Answers 2

Reset to default
35

The way that EV SSL certificates work is to stick an authority-specific OID in the certificate policies extension field of the cert (which is a standard X.509 certificate otherwise).

As EK said, the reference OIDs for each authority are shipped as part of the browser's root store of certificates. The user interfaces don't let you add a new CA and say "this is an EV capable CA and the UID is a.b.c.d.e.f".

I suppose it might be possible to build an open-source browser from source, adding your own CA's cert along with its EV oid to the root store, but you haven't really achieved much by doing so. The browser would no longer be compliant with the CA/Browser forum EV guidelines (which limit the EV-capable authorities).

Wikipedia has more info on EV certificates here:

http://en.wikipedia.org/wiki/Extended_Validation_Certificate

Improve this answer
0
2

No you can't. The trusted roots for these are fixed within the browser

Improve this answer
5
  • 3
    That just means you have to modify the browser. He specifically asked if he could "teach my browser to show it as EV". If it's FireFox or another browser whose source is available, then he can.
    – David Schwartz
    Aug 28, 2011 at 8:37
  • 1
    While he did actually say 'can I teach my browser', only you seeing your own cert as EV is entirely pointless. So the aim of my answer was to be practical rather than pedantic. If you want to get really picky my answer is still correct because compiling a whole new browser from source is not teaching your existing browser. :P
    – JamesRyan
    Aug 30, 2011 at 9:27
  • 5
    I do not agree that it is pointless. For example, in an organization it would be nice to put it on every browser to have all internal sites recognized.
    – some
    Aug 2, 2014 at 14:04
  • Why would you need an EV certificate for that? Remember this doesn't cover all certs, you can still add a trusted root for non EV certificates.
    – JamesRyan
    Aug 2, 2014 at 14:54
  • 1
    They are and they aren't. You can always import and remove certs from your trusted root certificate authority store. As a domain administrator for my organiation, I can push root certs to my managed users through policy so their browsers trust certificates that I generate for my internal servers. I too would like to know how to sign my internal certificates so that my users see "EV" level validation in their certificates. Wish someone could tell me what needs to be done to do that.
    – Erik
    Dec 2, 2017 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .