What is an Extended Validation (EV) SSL Certificate?

An EV SSL Certificate is a certificate used to configure HTTPS support on a website. To get an EV certificate, a Certificate Authority (CA) must verify the existence of the company the certificate will be issued to. Browsers usually display information about the company's existence in front of the website's domain name.

EV certificates use the same security methods as DV and OV certificates, but provide a higher level of protection thanks to the requirement to verify a company's existence with the certificate authority. The criteria for issuing EV certificates are defined in a special document called the Extended Validation Guidelines. The latest version of this document is 1.7.0 (as of August 1, 2019). The Guidelines are developed by the CA/Browser Forum, made up of certificate authorities and internet software vendors as well as representatives from the legal and audit professions.

History

In 2005, Comodo Group CEO Melih Abdulhayoglu organized the first meeting of what would later become the CA/Browser Forum. The purpose of the meeting was to develop standards for issuing SSL/TLS certificates. On June 12, 2007, the CA/Browser Forum officially approved the first version of the Extended Validation Guidelines, and the document took effect immediately. This official approval completed the infrastructure needed to identify trustworthy websites on the internet. Later, in April 2008, the CA/Browser Forum announced the release of a new version of the guidelines (1.1), based on the experience of certificate authorities and software vendors.

Motivation for Getting a Certificate

A key motivation for using digital certificates with SSL/TLS is to increase trust in online transactions. This requires website operators to be vetted in order to get a certificate. However, commercial pressures have led some certificate authorities to offer lower-tier certificates (domain validation). Domain-validated certificates existed before extended validation and generally required only some confirmations to verify domain control alone. In particular, domain-validated certificates don't claim that the legal entity has any relationship to the domain name — though the website may state that it belongs to that entity.

Initially, most browsers' user interfaces didn't distinguish between domain-validated and extended-validation certificates. Since a successful SSL/TLS connection resulted in a green padlock icon in most browsers, users were unlikely to know whether an extended-validation site had actually been vetted (as of January 2019, Chrome removed the green icons from the browser). As a result, fraudsters (including phishers) have been able to use TLS to increase the perceived trustworthiness of websites. Later browser users can always verify the identity of certificate holders by examining the information on an issued certificate (which includes the organization's name and address).

EV certificates are checked for compliance with advanced requirements in addition to the baseline ones. This requires manual validation of domain names requested by the applicant, verification by official government sources, verification by independent information sources, and phone calls to the company. If the certificate is issued, the company's registered number and physical address as recorded by the certificate authority are stored in the certificate.

EV certificates are designed to increase users' confidence that the website operator is a genuine, existing organization. However, concerns remain that the same lack of accountability that led to the loss of public trust in DV certificates could eventually erode the value of EV certificates too.

Issuance Criteria

Only certificate authorities that have passed an independent qualified audit may offer EV certificates, and all authorities must meet the following issuance requirements:

• Establish the legal existence of the entity and the site owner;
• Verify that the legal entity owns the domain;
• Verify the identity of the site owner and the authority of the people acting on the site owner's behalf.

Aside from EV certificates for .onion domains, it isn't possible to get a wildcard certificate with extended validation; instead, every fully qualified domain name must appear in the certificate and be verified by a certificate authority.

User Interface

EV-enabled browsers typically show the name and location of the organization the certificate belongs to. Browsers such as Microsoft Internet Explorer, Mozilla Firefox, Safari, Opera and Google Chrome support EV.

The extended validation rules require participating certificate authorities to assign a specific EV identifier after an independent audit; this identifier is assigned once other criteria are met. Browsers remember this identifier and match the EV identifier in the certificate against the relevant certificate authority: if they match, the certificate is recognized as valid. In many browsers, an EV certificate is indicated in the following ways:

• The name of the company or organization the certificate belongs to.
• A color, usually shown in green in the address bar, indicating the certificate was issued as HTTPS.
• A "lock" symbol in the address bar. Clicking the "lock" icon lets you see more information about the certificate, including the name of the certificate authority that issued the EV certificate.