Hacker News Reader

Comment by cesarb | Hacker News Reader

Interestingly, Certificate Patrol warned me that the certificate at that site changed from a "Domain Validation" to an "Organization Validation" certificate from the same CA.

Why did they do that change, and what would be the advantage for them of an OV instead of a DV certificate?

View on HN

OV are considered more secure than DV due to the higher registration requirements[0]. Additionally a DV certificate is good for a single domain, OV certificates are good for all of that organisation's domains. For example the NYT's certificate is valid for:

      DNS Name=nytimes.com
      DNS Name=*.blogs.nytimes.com
      DNS Name=*.blogs.stg.nytimes.com
      DNS Name=*.dev.nytimes.com
      DNS Name=*.nyt.com
      DNS Name=*.nytimes.com
      DNS Name=*.stg.nytimes.com

This simplifies deployment significantly.

[0] https://www.ssl.com/article/dv-ov-and-ev-certificates/

> OV are considered more secure than DV due to the higher registration requirements[0]

Nonsense. OV is no more secure than DV, just more expensive.

To be fair, it's more secure in the sense that someone who gets access to their domain name service can't generate their own OV cert without more access.

They could however create their own DV cert.

So while it uses the same technology, if you see an OC cert you can be more sure that it's the actual organization and not a cert that just proves that the domain is the domain.

But unless clients or humans do anything in response to the extra OV information, or in response to a lack of the extra OV information, that information has no security value.

No browsers do anything with OV data unless humans manually take action to examine the certificate. So I'm comfortable saying they offer negligible security value.

I think if a browser said "hey, this site used to have an OV cert, but now has a DV cert", and explained why that could be bad, that could be useful, though many non-technical users would probably not get the distinction. Sure, they don't do that now, but UI/UX around TLS has been improving a lot over the past few years.

(Certificate Patrol's noting of the reverse is a little silly though; why would you flag a change that denotes an increase in security...?)

DV certs can certainly have wildcards and multiple domains, and no, OV certs are not "more secure" - they simply contain additional fields which suggest that a CA has taken some amount of effort to verify that the domains belong to a given organisation, which the end user can read. This is generally more-or-less useless, as I'm pretty sure we all know that nytimes.com is owned by the New York Times.

And who reads the certificate anyway? I've never heard that an end user actually reads the content of the certificate. They just look for the green lock.

It would often be confusing anyway, as the legal entities the certificate is issued to can be named very different from the brand.

Reply on news.ycombinator.com