At what point do I need an extended-validation SSL certificates (EV) rather than the less expensive domain-validated SSL certificate?
closed as not constructive by John Conde♦ Dec 28 '12 at 0:26
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.
I think the (EV) is mostly snake oil. Most users wouldn't know what the green bar in their browser is really indicating compared to the standard SSL
therefore there is no increase in security.
The only (relevant) advantage is you have an authority that recognizes that your domain name matches the company name. This could be important in (assuming user knowledge):
That's mostly up to you, standard SSL's are perfectly fine and compliant. I would also decide based on the service or product i'm offering and the amount of security and trust that I had to provide visitors to the website. eCommerce for most products regular SSL is fine in my opinion. As the price of products and services reach $1,000 I would suggest getting the best SSL you could which makes the Green URL areas. I forget what they're called.
My view is that EV SSL is a convenient ploy by certificate authorities instead of fixing the broken chain of trust. It merely does what regular signed certificates did 10 years ago. Nonetheless, if you conduct business over the internet which requires protection against sophisticated phishing attacks, then you don't have a lot of other choices.
So when to definitely get EV SSL?
Right now, pretty much anyone can get an SSL certificate, including criminals who wish to stay anonymous, and they can get one for any website, including one that purports to be another organization. This wasn't always the case, as initially to get a signed certificate, CAs would perform extensive background checks to verify the identity of the website operator. That's why the certificates cost $100~200 and had a renewal fee each year. You were paying for the cost of verifying that you are who you claim to be.
Now, CAs buy their way into the chain of trust and then just use it as a way of essentially printing money. We pay them $20~100 each year for essentially doing nothing. They simply automatically generate a signed certificate that has no meaning and is issued without any checks or scrutiny on the website it's issued for. The only difference between a regular CA-signed certificate and a self-signed certificate is that the browser displays a scary message to users when it's self-signed. But there's no guarantee that one is safer than the other.
So the system is effectively broken, which the CAs saw as an excellent opportunity to create EV SSL and charge more money for this "deluxe" certificate—you know, one where they actually do the job they're supposed to.