Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Is any one aware of any data or studies from an impartial source that show the impact of EV SSL certificates on customer behavior? I've been unable to find any such studies. If an EV SSL certificate increases sales on a web store front by even a few points, I can see the value.

Aside from data targeted at EV SSL it may be possible to guess at customer behavior based on user interaction with regular SSL certificates. Are users even aware of SSL security? Does regular SSL have any proven effect on web store front sales?

Note, that I'm not asking about the necessity of good encryption - I'm asking about a potential customer's perception of security & trust.

share|improve this question
I can offer anecdotal evidence? –  Mark Henderson Jan 13 '11 at 1:40
@Farseeker Sure, why not? –  pygorex1 Jan 13 '11 at 8:49

2 Answers 2

EV SSL is a bit of a scam. It's basically a band-aid solution to a more fundamental problem—a breakdown in the chain of trust due to the lack of regulation in the issuing of SSL certificates. EV SSL certificates are basically there to do what regular SSL certificates were doing 10 years ago: to verify that a website is who it claims to be. That's why a chain of trust was created from the root CAs to make sure any site possessing an SSL certificate signed by a CA was on the level.

The reason you pay a CA an annual fee instead of creating a free self-signed certificate is because you need someone in the chain of trust to vouch for your identity. If the root CA is trusted, and they vouch for another CA, who in turn vouches for another CA, who vouches for another CA, who then vouches for somebank.com, then the chain of trust ensures that everyone is who they are, and the end user knows that somebank.com is really owned by Some Bank.

But for this to work, CAs need to do their homework and exercise some discretion in who they vouch for. If they certify another CA, they need to make sure that CA is trustworthy. If they certify a website, then they need to make sure it's not a phishing site posing as another company. That's the only reason to pay a CA for a signed certificate—because they're supposed to verify each site is owned by who they claim to be before issuing a certificate. And they're meant to verify this each year.

The creation of EV SSL is basically admitting that the original chain of trust is broken, that now there are CAs in the chain of trust that are neglecting their duty. So now we're going to create a new name for trustworthy certificates and make that the new standard. This basically makes all regular signed certificates worthless since end users can't trust that an SSL certificate signed by a trusted CA is actually any better than a self-signed certificate or one signed by an unknown company.

The real solution is to fix the chain of trust and force CAs to actually vet their certificate recipients and do their job. If a CA isn't doing its job, then it needs to be removed from the chain of trust. And this accountability should be required all the way up the chain to root CAs. Otherwise, we'll just end up with another level of certificates 10 years from now when commercial competition drives the price/quality of EV certificates down too.

share|improve this answer
I remember the hoops we had to jump through proving who we were when we got our first security certificate from Thawte. Then things changed. It actually feels like you've putting a deposit in Joe-Bob's mobile bank, the last few certs I've bought. No questions asked, no verification, no notarized documentation or business license asked for. An EV SSL from Network Solutions might be worth a little, but not vetted to the degree that Thawte used to do it. EV SSL from other providers? It's just a way of getting more money per year. –  Fiasco Labs Feb 16 '12 at 6:28

This is anecdotal evidence, not an impartial study or source, but when we implemented an EV Certificate we noticed almost no difference in sales. But that's mainly because we were a normal B2B commerce website, not a bank.

That said, yes, users are aware of what SSL is, but it didn't seem to make a huge difference to us. We used to run the entire website on SSL, and then decided to only switch the user to SSL during the login process (and keep them on SSL) and we actually found that traffic and sales increased (I don't know why?).

That said, you've hit the nail on the head - for us at least, it all seems to be about the perception of trust, rather than the actual act of encrypting the data.

share|improve this answer

protected by Community Mar 23 at 13:25

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.