Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At what point do I need an extended-validation SSL certificates (EV) rather than the less expensive domain-validated SSL certificate?

share|improve this question

closed as not constructive by John Conde Dec 28 '12 at 0:26

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

I think the (EV) is mostly snake oil. Most users wouldn't know what the green bar in their browser is really indicating compared to the standard SSL

Certificates issued by a CA under the EV guidelines are not structurally different from other certificates (and hence provide no stronger cryptography than other, cheaper certificates)


therefore there is no increase in security.

The only (relevant) advantage is you have an authority that recognizes that your domain name matches the company name. This could be important in (assuming user knowledge):

  1. The company has a lot of imitators and the company needs to distinguish themselves as the official site.
  2. The domain was purchased and you need to convey to users that you are indeed the company that you say you are.
  3. Your site is one that must convey the illusion of security. For example some investing sites might insist that you get the gold standard of SSL.
  4. Company details is in question and your users need to know this. If a company is changed around too much (ie company changed addresses with informing the authority) it might trigger a pull back from the authority as per page 16 of this document.
share|improve this answer

That's mostly up to you, standard SSL's are perfectly fine and compliant. I would also decide based on the service or product i'm offering and the amount of security and trust that I had to provide visitors to the website. eCommerce for most products regular SSL is fine in my opinion. As the price of products and services reach $1,000 I would suggest getting the best SSL you could which makes the Green URL areas. I forget what they're called.

share|improve this answer

My view is that EV SSL is a convenient ploy by certificate authorities instead of fixing the broken chain of trust. It merely does what regular signed certificates did 10 years ago. Nonetheless, if you conduct business over the internet which requires protection against sophisticated phishing attacks, then you don't have a lot of other choices.

So when to definitely get EV SSL?

  • Are you a bank or financial services organization?
  • Are you a major retailer with a recognizable and trusted brand?
  • Are you an organization who can suffer or cause significant financial losses if a rogue website is put up impersonating your organization?

Right now, pretty much anyone can get an SSL certificate, including criminals who wish to stay anonymous, and they can get one for any website, including one that purports to be another organization. This wasn't always the case, as initially to get a signed certificate, CAs would perform extensive background checks to verify the identity of the website operator. That's why the certificates cost $100~200 and had a renewal fee each year. You were paying for the cost of verifying that you are who you claim to be.

Now, CAs buy their way into the chain of trust and then just use it as a way of essentially printing money. We pay them $20~100 each year for essentially doing nothing. They simply automatically generate a signed certificate that has no meaning and is issued without any checks or scrutiny on the website it's issued for. The only difference between a regular CA-signed certificate and a self-signed certificate is that the browser displays a scary message to users when it's self-signed. But there's no guarantee that one is safer than the other.

So the system is effectively broken, which the CAs saw as an excellent opportunity to create EV SSL and charge more money for this "deluxe" certificate—you know, one where they actually do the job they're supposed to.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.