

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit?

I know that the browser shows green flag for EV certs. But is there any other benefit than just that?

share|improve this question
up vote 27 down vote accepted


For example, the EV certificate at will make the browser show a green bar and display "PayPal, Inc." next to it. This is designed not only to link the certificate to the domain owner (like standard domain-validated certificates do), but also link it to a more physical institution (here, PayPal, Inc.). To do this, the CA must verify that the named institution is indeed the one owning the domain.

Ultimately, this is more about making a more authenticated link between the domain name and the company name than making "more secure" certificates. From a cipher suite point of view (which is what determines the encryption algorithm and key size), EV certificates are no different from DV certificates (blue bar).

Stepping back a little, you need to realise that the effectiveness of HTTPS relies on the user checking that it's used correctly. (The server has no way to find out whether the client is victim of a MITM attack otherwise, unless using client-certificates too.) This means that the users have to:

  • check that HTTPS is used when they expect it to be,
  • check that there are no warnings,
  • check that the website they're using is indeed the one they're intending to visit, which leads to a couple of sub-points:
    • checking that it's the domain name they expect,
    • checking that the domain name belongs to the company they expect.

EV certificates are intended to solve that last sub-point. If you already know that belongs to, Inc. or that belongs to Google Inc., you don't really need them.

I'm not personally convinced that this approach completely works, since they can be misused (see NatWest/RBS example below) and some CAs seem to propagate vague (and potentially misleading) information as to what they really are, in an effort to promote them.

In general, if your users already know that your domain name is yours, you don't really need one.

Here are more details from a previous answer I gave to a similar question:



For example, it's useful for a institution that was initially known via its building (e.g. Bank of America) to be able to say that a certificate for is indeed for the place where you've given your physical money. In this case, it makes sense to use an OV or EV certificate. This can also be useful is there is ambiguity regarding which institution is behind the domain name (e.g. and, which is even more important is the similar domain name is owned by a rival/attacker using the name similarity for bad purposes.

In contrast, is what defines Google to the public; Google has no need to prove that belongs to the real Google. As a result, it's using a domain-validated certificate (same for

Again, this is really useful if the user knows how to check this. Browsers don't really help here. Firefox just says "which is run by (unknown)" if you want more details about the cert at, without really saying what is meant by this.


Unfortunately, this is sometimes used in a way that increases confusion, I think. Here is an example that you can check by yourself: one of the large UK banks (NatWest) uses the for its on-line banking services. It's far from obvious that the domain name belongs to NatWest (who also own the more logical name, by the way). Worse, the extended validation (if you check the name next to the green bar) is done against "Royal Bank of Scotland Group plc".



share|improve this answer
Thanks for the exhaustive answer. – Novice User Jun 10 '12 at 12:47
@Bruno, "blue bar"? Isn't it green? – Pacerier Apr 12 at 12:27
@Pacerier You're right, it is green now, it was blue then... (See for example: or screenshots at… ). The latest rules are here for Firefox:… – Bruno Apr 12 at 13:15

They are supposed to convey extra trust to the user that the certificate authority has done their job properly. The primary purpose of extended validation certificates however, is really just to generate extra revenue for certificate authorities.

Okay, enough of the snarky, basically they have to follow these guidelines before issuing one: EV Certificate Guidelines v.1.3. It covers things like requiring verifying the company/organization registration and address, and to get access to the signing keys needs two-factor authentication and every it is all meticulously logged.

share|improve this answer
-1. Second sentence is too rude/offensive. Could you remove or change it? – Andrei Botalov Jun 11 '12 at 10:00
Same reason for my downvote. – Peanut Jun 12 '12 at 13:52
same reason for my downvote also. – Ramhound Jun 20 '12 at 11:40
-1 rude/offensive. – JZeolla Jan 31 '13 at 14:05
Same reason for my upvote. – Alec Oct 2 '13 at 2:37

Your Answer


