Tim Callan's SSL Blog

I'm talking about the new standard for SSL Certificates that will go into production later this year. The code name is High Assurance, although the final name is not decided. Today I'll call them High Assurance. This new standard is currently in development among a consortium of Certificate Authorities and browser manufacturers in which VeriSign and Microsoft have taken leadership roles. The new standard will result in another kind of SSL Certificate in addition to the certificates we see today. Web sites will be able to purchase and deploy this new certificate type, and browsers will behave in a different and more positive way when these certificates are present.

You see, the trouble has to do with authentication. SSL Certificates as originally conceived all were to be authenticated quite well before they were issued for use on Web sites. Unfortunately in recent years a new sort of certificate has emerged, what we call a domain-authenticated SSL Certificate. This sort of certificate goes through almost no authentication before issuance. The reason that's a problem is the rise of another online trend --phishing. As phishing has increased dramatically, visitors to e-commerce sites, online banks, and the like have begun to look for the presence of an SSL Certificate as a sign that they're attached to the real site.

It happens, however, that phishers have been successful in obtaining domain-authenticated SSL Certificates to use on their fraud sites in order to fool more people into giving up confidential information. All documented cases of phishers using commercial SSL Certificates have been with domain-authenticated certificates, even though the actual sites they're counterfeiting have used organizationally authenticated certificates.

If it's gotten a little confusing at this point, let me state it plainly. The criminals who counterfeit online business sites in order to steal your money have found a soft target, a way to make their fraudulent sites appear in the browsers to be the genuine sites. That way is domain-authenticated certificates. And the only reason it works is because the low-security certificates (domain-authenticated) look exactly like the high-security ones (organizationally authenticated). This confusion has been exploited by the bad guys, and the people who shop or bank or file their taxes online have decreased their willingness to do so because they're afraid the bad guys are going to victimize them.

That's where High Assurance SSL Certificates come in. These certificates will look different to the browsers, and the browsers will be able to display them differently as a result. I expect Internet Explorer 7.0 to be the first browser taking advantage of this functionality with others following suit. Internet Explorer will show an old-fashioned SSL Certificate in much the same way it does today. But a High Assurance certificate will get very different treatment. In this case the browser will actually turn the address bar green, a very clear indication that this is a different kind of site you're attached to right now. Also, the name of the organization running this site and the name of the CA who issued the certificate will appear in the address bar adjacent to the actual domain you've visited. These cues will make it easy for any site visitor using this browser to tell the difference between High Assurance and traditional SSL Certificates.

The reason this new interface matters is that High Assurance certificates will be held up to a uniformly high standard of authentication, an authentication level that has never been fooled by a phisher or other cybercriminal. If every Internet user in the world had a browser that recognized the difference between High Assurance SSL Certificates and traditional ones and if every legitimate site used a High Assurance certificate, then phishing as we know it today would essentially be eliminated. Of course, adoption of both these browsers and these certificates will take some time. Nonetheless, this initiative is an exciting development in fighting phishing.

I'll keep you informed as this standard comes together. Keep an eye on this blog for the latest information on how it's progressing.