ev-checker is a standalone command-line utility for determining if a given EV policy fulfills the requirements of Mozilla's Root CA program and may thus be enabled.

ev-checker depends on the libraries NSS and NSPR. It additionally makes use of mozilla::pkix. Since mozilla::pkix has not been released as a stand-alone library yet, this project imports a snapshot of the implementation. (See the file pkix-import.) ev-checker implements a mozilla::pkix::TrustDomain and uses mozilla::pkix::BuildCertChain to determine if a given EV policy meets the requirements to be enabled in Firefox.

First, compile with make. There is no guarantee of portability, so feel free to file issues if this does not work as expected.

Then, given the file cert-chain.pem, the dotted OID of the EV policy, and a hostname to validate against, run ev-checker like so:

./ev-checker -c cert-chain.pem -o dotted.OID -h hostname

-c specifies the file containing a sequence of PEM-encoded certificates. The first certificate is the end-entity certificate intended to be tested for EV treatment. The last certificate is the root certificate that is authoritative for the given EV policy. Any certificates in between are intermediate certificates.

If run with the flag -d and a description of the EV OID, ev-checker will output a blob of text that must be added to security/certverifier/ExtendedValidation.cpp in the mozilla-central tree for Firefox to consider this a valid EV policy. It will also validate the end-entity certificate. If it succeeds, the EV policy is ready to be enabled. If not, something needs to be fixed. Hopefully ev-checker emitted a helpful error message pointing to the problem.

$ ev-checker -c chain.pem -o 2.16.840.1.114412.2.1 -d "Digicert EV OID" -h addons.mozilla.org

// CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
"2.16.840.1.114412.2.1",
"Digicert EV OID",
SEC_OID_UNKNOWN,
{ 0x74, 0x31, 0xE5, 0xF4, 0xC3, 0xC1, 0xCE, 0x46, 0x90, 0x77, 0x4F,
  0x0B, 0x61, 0xE0, 0x54, 0x40, 0x88, 0x3B, 0xA9, 0xA0, 0x1E, 0xD0,
  0x0B, 0xA6, 0xAB, 0xD7, 0x80, 0x6E, 0xD3, 0xB1, 0x18, 0xCF },
"MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
"EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
"bmNlIEVWIFJvb3QgQ0E=",
"AqxcJmoLQJuPC3nyrkYldw==",
Success!

• Do OCSP fetching
• Other policy issues
• More helpful error messages