Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is any one aware of any data or studies from an impartial source that show the impact of EV SSL certificates on customer behavior? I've been unable to find any such studies. If an EV SSL certificate increases sales on a web store front by even a few points, I can see the value.

Aside from data targeted at EV SSL it may be possible to guess at customer behavior based on user interaction with regular SSL certificates. Are users even aware of SSL security? Does regular SSL have any proven effect on web store front sales?

Note, that I'm not asking about the necessity of good encryption - I'm asking about a potential customer's perception of security & trust.

share|improve this question
I can offer anecdotal evidence? – Mark Henderson Jan 13 '11 at 1:40
@Farseeker Sure, why not? – pygorex1 Jan 13 '11 at 8:49

EV SSL is a bit of a scam. It's basically a band-aid solution to a more fundamental problem—a breakdown in the chain of trust due to the lack of regulation in the issuing of SSL certificates. EV SSL certificates are basically there to do what regular SSL certificates were doing 10 years ago: to verify that a website is who it claims to be. That's why a chain of trust was created from the root CAs to make sure any site possessing an SSL certificate signed by a CA was on the level.

The reason you pay a CA an annual fee instead of creating a free self-signed certificate is because you need someone in the chain of trust to vouch for your identity. If the root CA is trusted, and they vouch for another CA, who in turn vouches for another CA, who vouches for another CA, who then vouches for somebank.com, then the chain of trust ensures that everyone is who they are, and the end user knows that somebank.com is really owned by Some Bank.

But for this to work, CAs need to do their homework and exercise some discretion in who they vouch for. If they certify another CA, they need to make sure that CA is trustworthy. If they certify a website, then they need to make sure it's not a phishing site posing as another company. That's the only reason to pay a CA for a signed certificate—because they're supposed to verify each site is owned by who they claim to be before issuing a certificate. And they're meant to verify this each year.

The creation of EV SSL is basically admitting that the original chain of trust is broken, that now there are CAs in the chain of trust that are neglecting their duty. So now we're going to create a new name for trustworthy certificates and make that the new standard. This basically makes all regular signed certificates worthless since end users can't trust that an SSL certificate signed by a trusted CA is actually any better than a self-signed certificate or one signed by an unknown company.

The real solution is to fix the chain of trust and force CAs to actually vet their certificate recipients and do their job. If a CA isn't doing its job, then it needs to be removed from the chain of trust. And this accountability should be required all the way up the chain to root CAs. Otherwise, we'll just end up with another level of certificates 10 years from now when commercial competition drives the price/quality of EV certificates down too.

share|improve this answer
I remember the hoops we had to jump through proving who we were when we got our first security certificate from Thawte. Then things changed. It actually feels like you've putting a deposit in Joe-Bob's mobile bank, the last few certs I've bought. No questions asked, no verification, no notarized documentation or business license asked for. An EV SSL from Network Solutions might be worth a little, but not vetted to the degree that Thawte used to do it. EV SSL from other providers? It's just a way of getting more money per year. – Fiasco Labs Feb 16 '12 at 6:28
'The real solution is to fix the chain of trust and force CAs to actually vet their certificate recipients and do their job' that's what the EV guidelines are for! You seem to want to improve standards for validation while rejecting improved standards for validation. – mikemaccana Sep 9 '15 at 13:12
@mikemaccana No, that's what revised baseline requirements are supposed to be for. The EV guidelines create a class of premium certificates that serve the role of original signed certificates, which does not address the issue of lapsed enforcement of baseline requirements. How does the introduction of EV certificates fix regular CA signed certificates being poorly audited? Is there an incentive to buy EV certificates if the baseline requirements are shored up and properly enforced? – Lèse majesté Sep 9 '15 at 17:35
If you're still having trouble following, please read Peter Gutmann's commentary on PKI-Me-Harder (p72): cs.auckland.ac.nz/~pgut001/pubs/book.pdf – Lèse majesté Sep 9 '15 at 17:42
@Lèsemajesté Agreed that domain validation is awful, but the CA's (by their own doing) have painted themselves into a corner: people expect to be able to get SSL certificates for cheap/free instantaneously. Removing domain validation or adding proper verification of legal entities to DV requirements would cause another outcry. I agree that DV is poor validation, and the blame is entirely on CAs for making domain validation a standard way of getting an SSL cert, but unfortunately it's what people expect at this point. – mikemaccana Sep 10 '15 at 14:29

This is anecdotal evidence, not an impartial study or source, but when we implemented an EV Certificate we noticed almost no difference in sales. But that's mainly because we were a normal B2B commerce website, not a bank.

That said, yes, users are aware of what SSL is, but it didn't seem to make a huge difference to us. We used to run the entire website on SSL, and then decided to only switch the user to SSL during the login process (and keep them on SSL) and we actually found that traffic and sales increased (I don't know why?).

That said, you've hit the nail on the head - for us at least, it all seems to be about the perception of trust, rather than the actual act of encrypting the data.

share|improve this answer

I too have been unable to find independent studies showing an increased perception of trust associated with the green bar.

Digicert published a white paper pompously titled "The Impact of Extended Validation (EV) Certificates on Customer Confidence" claiming that 59% more users "said they were most likely to enter their details" into a site displaying an EV SSL certificate vs. a regular one. But if you read how the study was done, it's ludicrous:

In a recent study, Tech-Ed taught 384 people that companies with EV SSL Certificates on their website go through a more rigorous validation process than those with standard SSL Certificates. They also taught them that sites secured with EV SSL Certificates could be identified by their green bar. After completing the study, Tech-Ed found the following: [...]

There's also no mention of what exactly "Tech-Ed" was back in 2007 when it allegedly conducted the study.

Verisign published a white paper in 2009 citing a 10% increase in conversions for users in older demographics:

Japanese consumer products company Lion Corporation focuses its E-commerce site on the elderly, who are often new to Internet shopping and especially concerned about divulging personal information. To help quell their fears, Lion adopted VeriSign® Extended Validation (EV) SSL Certificates, which delivered 10% more conversions for users who saw the green bar.*

*Your company’s results could vary. VeriSign, Inc. and its subsidiaries make no warranties of any kind (whether or express, implied or statutory) with respect to the services described or information contained herein.

Wikipedia mentions no studies on the topic.

This article links to some studies showing that badges and seals (rather than EV certs) increase conversion rate.

share|improve this answer

protected by Community Mar 23 '14 at 13:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.