Extended Validation SSL certificates
-
E
EV SSL Certificate — This certificate adds HTTPS to a site. To get an EV certificate, your company must prove it exists. A trusted authority checks this. Browsers then show your company's name near the site's web address.
EV certificates use the same security as DV and OV certificates. But EV adds one more step: proving your company is real. The rules for issuing EV certificates come from a document called the Guidelines for Extended Validation. As of August 1, 2019, the current version is 1.7.0. A group called the CA/Browser Forum wrote this document. Its members include certificate authorities, software makers, and legal experts.
-
-
1
Story
In 2005, Comodo Group's CEO, Melih Abdulkhayoglu, held the first meeting of what became the CA/Browser Forum. The goal was to improve SSL/TLS certificate rules. On June 12, 2007, the group approved the first Extended Validation Guide. It took effect right away. This gave the internet a clear way to show which websites could be trusted. In April 2008, the group released an updated version (1.1), based on feedback from certificate authorities and software makers.
The motivation for obtaining a certificate
People need to trust online transactions. SSL/TLS certificates help build that trust. At first, this meant website owners had to pass a real check. But over time, some certificate authorities began offering cheaper, easier certificates. These only check that you control a domain — not that a real business owns it. This is called Domain Validation.
For a while, browsers showed the same green lock icon for every type of certificate. So most users couldn't tell a fully checked site from a barely checked one. (Chrome removed the green lock icon in January 2019.) Scammers took advantage of this. They used basic certificates to make fake or phishing sites look trustworthy. Today, users can still check a site's certificate details — including the company name and address — if they look closely.
EV certificates go through a much stricter check. This includes:
- Manual checks of the domain name
- Checks against official government records
- Checks from independent sources
- A phone call to the company
If the check passes, the certificate stores the company's official registration number and address. EV certificates exist to build stronger user trust. But some worry EV certificates could lose their value over time — the same way basic DV certificates did.
-
2
Rules for Getting an EV Certificate
Only certificate authorities that pass an independent audit can issue EV certificates. Every authority must confirm:
- The business and website owner really exist
- The business truly owns the domain
- The identity of the site owner, and the authority of anyone acting on the owner's behalf
There's one exception: EV certificates for .onion domains. Outside of that, EV certificates can't cover wildcard domains. Every domain name must be listed and checked one by one.
-
3
What You See in the Browser
Browsers that support EV show proof of the check — usually the company's name and location. Microsoft Internet Explorer, Mozilla Firefox, Safari, Opera, and Google Chrome all support EV.
To use this feature, a certificate authority must pass an audit and meet other rules. It then gets a special EV ID. Browsers store this ID and match it against the certificate. If they match, the certificate is trusted. Many browsers show this in three ways:
- The company or organization name
- A colored bar (often green) in the address bar, showing the site uses HTTPS
- A lock icon in the address bar — click it to see more details, including which authority issued the certificate
-
Update! 09.29.2019
Google Chrome version 77 is released now for Windows, Linux, macOS, ChromeOS, IOS and Android users. The new release removed the UI indicator for Extended Validation (EV) certificates from the browser's address bar, it is also known as "Green Address Bar".
-
