{"id":12008,"date":"2020-01-29T16:23:45","date_gmt":"2020-01-29T21:23:45","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12008"},"modified":"2020-01-31T11:23:23","modified_gmt":"2020-01-31T16:23:23","slug":"digicert-leads-initiative-to-enhance-ev-ssl-certificates","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/digicert-leads-initiative-to-enhance-ev-ssl-certificates\/","title":{"rendered":"DigiCert Leads Initiative to Enhance EV SSL Certificates"},"content":{"rendered":"\n

In collaboration with several other certificate authorities, DigiCert has proposed 4 enhancements to the EV SSL validation processes<\/h2>\n\n\n\n
\"Graphic:<\/figure><\/div>\n\n\n\n

“On the Internet, nobody knows you’re a dog.”<\/p>\n\n\n\n

Cartoonist Peter Steiner penned those words in a cartoon strip all the way back in 1993. The cartoon was funny and made a lot of people laugh, but it was highlighting a serious issue that was just developing back then\u2014how easy it was to trick people via the anonymity of the internet. Unfortunately, Peter nailed it! Today, that problem is even bigger than anyone \u2013 even Peter \u2013 could have imagined\u20141 in 25 branded emails is actually a phishing email<\/a>.<\/p>\n\n\n\n

So, why is online identity so important? How will DigiCert\u2019s\nproposal help consumers?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

Why Online Identity Is So Important<\/h2>\n\n\n\n

The internet is flooded with unknown actors, and a lot of\ntimes they\u2019re up to nefarious activities\u2014phishing, bullying, catfishing, scamming,\npreying on children, swatting, and more. That\u2019s why most internet users tend to\nbe suspicious of interactions with people, websites, and companies they don\u2019t\nknow\u2014typically, we want to know the real-world identity of the individuals and\ncompanies we interact with online.<\/p>\n\n\n\n

What would you think if you went to your local shopping\ncenter and saw a shop with no business name, like this?<\/p>\n\n\n\n

\"Graphic:<\/figure><\/div>\n\n\n\n

You\u2019d be intrigued \u2014 but you probably wouldn\u2019t trust that company. You\u2019d certainly have some questions! Customers don\u2019t trust anonymity \u2014 they want to know who they\u2019re doing business with.<\/p>\n\n\n\n

The same thing is true online \u2014 customers want to know who they\u2019re buying from. At your local mall, it\u2019s pretty easy to tell who you\u2019re buying from \u2014 there\u2019s a physical store with signage and staff right in front of you. Online, though, identity can be\u2026 slippery. As Steiner pointed out, you can be a dog, a scammer, or a predator\u2026 and nobody will know until it\u2019s too late.<\/p>\n\n\n\n

In an environment saturated with anonymous trouble-makers, EV SSL is a great tool consumers can use to confidently see who runs a website, helping them decide whether to trust the website owner or not. That\u2019s why we strongly support making EV SSL as strong and usable as possible \u2014 people want\/need what it can provide. And that\u2019s why we\u2019re excited to see DigiCert leading the charge to update and enhance EV SSL.<\/p>\n\n\n\n

DigiCert\u2019s 4-Pronged Proposal to Enhance EV SSL<\/h2>\n\n\n\n

DigiCert is proposing four specific ways to update and enhance the CA\/B Forum standards for EV SSL certificates. These enhancements will make EV SSL stronger and satisfy some \u201cweaknesses\u201d pointed out by security researchers. Let\u2019s go through each of them, and see how they\u2019ll help improve online identity for all:<\/p>\n\n\n\n

1. Enforce Validation Level via CAA Records<\/h3>\n\n\n\n

A CAA record is a DNS entry that lets website managers restrict which CAs may issue certificates for their domain. It\u2019s a great tool for fighting shadow IT certificates \u2014 ensuring that an organization\u2019s certificates are centrally managed and authorized. <\/p>\n\n\n\n

But currently CAA records can only specify certificate\nauthorities. DigiCert is proposing expanding CAA records so domain admins can control\nor restrict the validation level of certificates that can be issued for their\ndomain. For example, a website admin could restrict their domain to only issue EV\nSSL certificates from a certain CA.<\/p>\n\n\n\n

Why This Is Beneficial:<\/strong><\/p>\n\n\n\n

Let\u2019s look at a hypothetical scenario. Let\u2019s say example.com hires a freelance web designer to update their blog with a fresh, new design for 2020. That designer isn\u2019t authorized to issue SSL certificates for the domain. But let\u2019s say the website designer installs a WordPress file editor plugin, so they can complete domain control validation and get an SSL certificate issued. Example.com now has an SSL certificate issued by an unauthorized party \u2014 they don\u2019t control the certificate or the private key, which is a significant security issue. What happens when the certificate expires?<\/p>\n\n\n\n

If example.com had implemented a CAA record that restricted\nthe domain to EV certificates from DigiCert CA only, the web designer wouldn\u2019t\nhave been able to get that certificate issued because any attempt to get a\ncertificate type not identified in the CAA record would fail.<\/p>\n\n\n\n

2. Include LEI Data in SSL Certificates<\/h3>\n\n\n\n

If you\u2019ve got a feeling of d\u00e9j\u00e0 vu right now, it might be because we mentioned this idea back in October 2019<\/a>. TL;DR:<\/p>\n\n\n\n

LEIs are Legal Entity Identifiers, they were created in the aftermath of the financial crisis that occurred a decade ago. They are numerical codes recognized by 150 different countries. The entire system is overseen by a Swiss non-profit called GLEIF. An LEI can help prevent collisions and confusion. Now, I can already hear the objections percolating, that, like confusing organizational names, people won\u2019t know what to do with an LEI number. But there are several workarounds for that. For one, the browser could just use the LEI code and generate the associated information. Granted that might require an additional call, which may be anathema to browsers \u2013 but it\u2019s an option. You could also make it easy to click on the LEI number and follow it to a database with the information. This would require the user to take an action, but some might find it useful. But more than anything, it could send up a red flag when an eCommerce website or some other organization that transacts in valuable data DOESN\u2019T have an LEI.”<\/p><\/blockquote>\n\n\n\n

Why This Is Beneficial:<\/strong><\/p>\n\n\n\n

Adding LEIs to EV SSL certificates offers two key benefits:<\/p>\n\n\n\n