如何构建EV SSL证书？
我正在研究 SSL 和 X.509 证书。我正在尝试从头开始创建 CA 证书并使用它来签署另一个自定义服务器证书。然后，我在 Firefox 证书管理器中安装 CA 证书。一切正常，我什至可以使用自己的证书连接到服务器。但我无法构建 EV 证书（即我的 Firefox 地址栏保持蓝色，而不是绿色）。
所以，问题是：有人可以给我一些提示，EV CA 和服务器证书的独特品质使 Firefox 信任它们吗？
I am studying SSL and X.509 certificates. I am trying to create a CA certificate from scratch and use it to sign another custom server certificate. Then, I install the CA certificate in the Firefox certificate manager. Everything works fine, and I am even able to connect to the server with my own certificate. But I can't build an EV certificate (i.e. my Firefox address bar stays blue, not green).
So, the question is: can someone please give me a hint which are the distinctive qualities of the EV CA and server certificates that make Firefox trust them?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您无法构建 EV 证书。 EV 证书与常规证书不同，它是通过自定义扩展（策略 ID 扩展）来实现的，该扩展由现有 CA 放置到其证书中。浏览器会检查扩展名（是否存在于策略 ID 列表中，已知属于 EV 证书）和颁发者字段，并且它们必须匹配。如果你尝试使用现有公司的策略ID，我相信浏览器不会接受它/。
You can not build an EV certificate. The EV certificate is different from regular certificate by custom extension (policy ID extension), which is placed by existing CAs to their certificates. The browser checks both the extension (whether it is present in the list of policy IDs, known to belong to EV certificates) and the issuer field and they must match. If you try to use policy ID of existing company, I believe the browser won't accept it/.