I am very familiar with OpenPGP but don\'t even use X.509 / S/MIME. I know that

Question

I am very familiar with OpenPGP but don't even use X.509 / S/MIME. I know that there are several classes for certificates (from email check to personal ID check). I would like to know how you determine the class of a certificate.

Is this information part of the CA signature? Or is that an organuzational feature only, using different root certificates for different classes? I noticed that one CA has different root certificates which have the class number in their name. Is there a real attribute for a root certificate which tells the user the class?

Explanation / Answer

Certificate "class" is essentially a marketing terminology. Each CA is free to call some of the certificates "class 0" or "class 1" or whatever, roughly meaning "I issued that but I did not bother to check" or "this time I did some checks because the owner paid me enough for that".

Theoretically, as per X.509 rules, the "class" should be encoded in the certificate as a Certificate Policies extension: the CA can put there some OID which designate the set of procedures applied for the issuance of the certificate. However, these OID are CA-specific, and can be understood only by having a look at the Certification Practice Statement, a legal-looking document that may or may not be referenced from the CP extension, and is usually a 200-pages PDF file that cannot be digested by a computer, only by a human being (or a lawyer).

Recently, some commercial CA and browser vendors have reached some agreement about Extended Validation certificates, which can be thought of as "upper class" certificates (certificates where the CA actually applied some care in the process), and are indeed identified by their CP extensions. Yet the identification is still made relatively to a big list of "EV-compliant policy OID" that clients (Web browser) somehow know in advance (it is maintained by the browser vendors).

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.