SSL Certificate

An SSL certificate (strictly speaking, a TLS certificate) is a digital certificate with which a certificate authority (CA) vouches for the identity of a website's operator and that is used to encrypt communication between the browser and the server. A site with a valid certificate can be accessed with a URL starting with https://, and you can check the contents of the certificate by opening the icon in the address bar (its design differs by browser and version).

If the link destination of a QR code is an HTTP site without an SSL certificate, two problems arise. First, because communication is not encrypted, there is a risk that the personal data or credit card information the user enters after the scan will be eavesdropped on. Second, because the browser displays a "Not secure" warning, users feel uneasy and leave. To ensure the trustworthiness of a QR code, HTTPS support at the link destination is essential.

SSL certificates come in three validation levels. DV (Domain Validation) is the most basic certificate, which checks only ownership of the domain, and it can be obtained for free from Let's Encrypt. OV (Organization Validation) also checks that the organization actually exists. EV (Extended Validation) is issued after the strictest review. The company name used to be shown in the address bar at all times. In Chrome 77 and Firefox 70 (both in 2019), however, this display was moved to the page information opened from the icon in the address bar, and today it is checked by opening the certificate details. For the link destinations of QR code payments and financial services, a certificate of OV or higher is recommended.

From the standpoint of phishing countermeasures, the presence of an SSL certificate alone cannot guarantee safety. This is because attackers can also obtain DV certificates and build HTTPS phishing sites. After scanning a QR code, the habit of checking whether the domain name in the URL is the legitimate one is important.