nanog mailing list archives
Re: EV SSL Certs
From: Jimmy Hess <mysidia () gmail com>
Date: Mon, 12 Sep 2011 18:39:41 -0500
On Mon, Sep 12, 2011 at 7:08 AM, Coy Hile <coy.hile () coyhile com> wrote:
As an academic aside, exactly what would one set on his (internal) root CA so that internally-trusted certs signed by that CA would show up as EV certs?
This is not possible without changing browser source code and recompiling (or debugging/editing the browser binary). The IDs of certificates that are allowed to sign EVSSL CAs are hard-wired in the browser. In some browsers, this also means it's impossible for an end user to "untrust" or remove an EVSSL CA. It also means you cannot as a site adminsitrator, make an administrative decision to internally add an internal EVSSL CA, without customizing every browser. If you ask me... it's shoddy software design. EVSSL CAs should be configurable, but none of the major browsers provide the knobs to manually add or remove EVSSL access to/from a trusted CA. -- -JH
Current thread:
- Re: EV SSL Certs Coy Hile (Sep 12)
- Re: Re: EV SSL Certs Cody Rose (Sep 12)
- Re: EV SSL Certs Jimmy Hess (Sep 12)
- Re: EV SSL Certs Coy Hile (Sep 12)