ssl证书类型区别

Love The Way You Lie 2022-07-13 03:55 148阅读 0赞

引用：http://blog.chinaunix.net/uid-15790905-id-5575366.html

虽然ssl证书的制作原理、加密方式大同小异，但在SSL类型上还是有很大区别的。  
我们经常见到的https网站，地址栏大都是绿色。这些都是使用的EV证书，属于经过正规安全厂商认证，安全级别最高的证书，基本可以认为绿色地址栏的网站不是钓鱼/诈骗网站。  
其实还有其他类型的https证书，当然它们的价格也是不同的，所以在选购https证书的时候，一定需要看清楚SSL类型，在同类型的证书中选择价格最优的。  
  
粗粒度地整理了DV, OV, EV三种SSL证书的区别，如下表

<table style="word-wrap:break-word; color:rgb(102,102,102); line-height:21px; margin-left:0px; table-layout:fixed; width:980px; font-family:Consolas; font-size:14px"> 
 <tbody style="word-wrap:break-word"> 
  <tr style="word-wrap:break-word"> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:163px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">证书类型</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:206px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">DV (Domain Validation)</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:212px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">OV (Organization Validation)</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:301px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">EV (Extended Validation)</span></td> 
  </tr> 
  <tr style="word-wrap:break-word"> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:163px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">申请资料</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:206px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">域名所有权</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:212px"> 
    <div style="word-wrap:break-word"> 
     <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">OV授权书</span> 
    </div> 
    <div style="word-wrap:break-word"> 
     <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">公司营业执照扫描件</span> 
    </div> 
    <div style="word-wrap:break-word"> 
     <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">等（可搜索查看详情）</span> 
    </div> </td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:301px"> 
    <div style="word-wrap:break-word"> 
     <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">EV授权书</span> 
    </div> 
    <div style="word-wrap:break-word"> 
     <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">公司营业执照扫描件</span> 
    </div> 
    <div style="word-wrap:break-word"> 
     <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">律师函</span> 
    </div> 
    <div style="word-wrap:break-word"> 
     <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">等（可搜索查看详情）</span> 
    </div> </td> 
  </tr> 
  <tr style="word-wrap:break-word"> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:163px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">CA审核方式</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:206px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">机器审核</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:212px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">人工审核</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:301px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">人工审核</span></td> 
  </tr> 
  <tr style="word-wrap:break-word"> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:163px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">申请耗时</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:206px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">小时</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:212px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">一般在几个工作日</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:301px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">一般在几个工作日</span></td> 
  </tr> 
  <tr style="word-wrap:break-word"> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:163px"> <span style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px"><span style="word-wrap:break-word">绿色地址栏</span></span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:206px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">无</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:212px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">无</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:301px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">有</span></td> 
  </tr> 
  <tr style="word-wrap:break-word"> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:163px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">安全保障</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:206px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">密文传输</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:212px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">密文传输</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:301px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">密文传输</span></td> 
  </tr> 
  <tr style="word-wrap:break-word"> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:163px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">单域名价格Geotrust.com</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:206px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">$49/year (rapidssl)</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:212px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">$199/year</span></td> 
   <td style="word-wrap:break-word; margin:0px; padding:10px; border:1px solid rgb(219,219,219); width:301px"> <span style="word-wrap:break-word; font-size:14px; color:rgb(0,0,0)">$299/year&nbsp;</span></td> 
  </tr> 
 </tbody> 
</table>

域名所有权可以通过两种途径来验证  
1. whois查出来的Registrant Contact Email  
2. 在对应域名所在服务器上放置特定文件，供CA厂商验证

直观上区分EV、DV与OV证书

1. 绿色地址栏，都是EV证书，DV与OV证书区分参考[这儿][Link 1]

2. 个人感觉OV证书的性价比不高，通过地址栏颜色无法区别DV/OV证书，需要点开https证书详情才能区别。对于普通网民而言，鉴别代价较大。

3. 由于申请EV证书需要提供详细的材料，所以对于地址栏是绿色的网站，基本不会是钓鱼或诈骗网站。如果是电子商务的网站，最好使用EV证书。

另外，国内的SSL证书一般要比国外的贵，即使是国外CA厂商在国内的代理。在选购的SSL证书的时候需要多对比几家CA厂商。  
  
参考资料:

[https://www.ssl.com/article/dv-ov-and-ev-certificates/][https_www.ssl.com_article_dv-ov-and-ev-certificates]

[https://opensrs.com/blog/2015/05/dv-ov-or-ev-how-to-offer-the-right-ssl-certificate/][https_opensrs.com_blog_2015_05_dv-ov-or-ev-how-to-offer-the-right-ssl-certificate]

[https://www.globalsign.com/en/ssl-information-center/types-of-ssl-certificate/][https_www.globalsign.com_en_ssl-information-center_types-of-ssl-certificate]

[https://www.ssl.com/faqs/requirements-for-ssl-com-ev-/][https_www.ssl.com_faqs_requirements-for-ssl-com-ev-]

[https://www.ssl.com/faqs/requirements-for-ssl-com-ov-certificates/][https_www.ssl.com_faqs_requirements-for-ssl-com-ov-certificates]

[https://www.digicert.com/subject-alternative-name-compatibility.htm][https_www.digicert.com_subject-alternative-name-compatibility.htm]   
[https://www.wosign.com/OVSSL/index.htm][Link 1]

[Link 1]: https://www.wosign.com/OVSSL/index.htm
[https_www.ssl.com_article_dv-ov-and-ev-certificates]: https://www.ssl.com/article/dv-ov-and-ev-certificates/
[https_opensrs.com_blog_2015_05_dv-ov-or-ev-how-to-offer-the-right-ssl-certificate]: https://opensrs.com/blog/2015/05/dv-ov-or-ev-how-to-offer-the-right-ssl-certificate/
[https_www.globalsign.com_en_ssl-information-center_types-of-ssl-certificate]: https://www.globalsign.com/en/ssl-information-center/types-of-ssl-certificate/
[https_www.ssl.com_faqs_requirements-for-ssl-com-ev-]: https://www.ssl.com/faqs/requirements-for-ssl-com-ev-/
[https_www.ssl.com_faqs_requirements-for-ssl-com-ov-certificates]: https://www.ssl.com/faqs/requirements-for-ssl-com-ov-certificates/
[https_www.digicert.com_subject-alternative-name-compatibility.htm]: https://www.digicert.com/subject-alternative-name-compatibility.htm