288109 - No consumer differentiation between Class 2 and Class 3 SSL certificates

Status: RESOLVED EXPIRED

(Firefox :: Security, defect)

Description

[Scott Harris]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Build Identifier: 

Class 2 Certificates should be differentiated from Class 3 Certificates.   
There are two distinct purposes behind Digital Certificates, one is to encrypt 
a browser/server session, and the other is to authenticate that the person you 
are talking to IS IN FACT the person that you are talking to.  These two 
purposes were designed into certificates from the time they were invented by 
RSA as well as PGP.  

Class 3 certificates are fully validated certificates where a company has had 
to send in their organizational documents and have them verified by a trusted 
third party.  Class 2 certificates are domain name ONLY validated and cannot 
be used to truly validate the owner of the certificate.  

For example, if I buy a domain name called www.secure-AOL-payment-center.com 
and put in the registration information that I am "America Online" then I can 
get a Class 2 SSL certificate proclaiming that I am "America Online", which 
does nothing to truly reflect who I actually am.

Someone would not be able to get a Class 3 certificate for that company name, 
because they would fail authentication.

In the past, the only trusted certificate authorities only offered Class 3 
certificates, but since now more and more companies are offering Class 2 
certificates, it is important to give the customers SOME indication as to 
which kind of certificate they are dealing with when they connect to a secure 
page.

I suggest that all Class 2 certificates get a silver colored padlock and all 
Class 3 certificates be given a gold padlock.  Also, when they click on the 
padlock for more information, it should give a short description explaining 
that it is a Class 2 certificate or a Class 3 certificate and what that means.



Reproducible: Always

Steps to Reproduce:
1. Connect to https://www.XRamp.com (Class 3 Certificate)
2. Connect to https://www.godaddy.com
3.

Actual Results:  
Both sites showed a gold padlock and SSL secured.  No Differentiation between 
Class 3 certificates and Class 2 Certificates

Expected Results:  
Differentiation between Class 2 and Class 3 certificates

Comment 1

[Gervase Markham [:gerv]]

While recognising the issue, I note that the suggested UI change:

> I suggest that all Class 2 certificates get a silver colored padlock and all 
> Class 3 certificates be given a gold padlock. 

is not workable. You can't differentiate between two bits of UI, particularly
not two bits as crucially different as this, solely on the basis of color.

We are currently working out how best to tackle this issue and the wider issues
surrounding it.

Do certificates identify themselves as Class 2 or Class 3? Or do the roots? Or
is that just a term you are using?

Gerv

Comment 2

[Steve Smith]

*** Bug 285131 has been marked as a duplicate of this bug. ***

Comment 3

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 4

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.