Are EV Certificates Worth It?
What Extended Validation Involves
An EV certificate, or extended validation certificate, is a publicly trusted SSL certificate that a certificate authority issues only after a stricter check of the organization than DV or OV requires. The encryption is the same as in any other certificate. The difference lies in the identity checks behind it, which are compared across the validation levels.
The rules for EV come from guidelines written by the CA/Browser Forum. They require the CA to confirm the organization's legal name, registration, physical address and operational existence, and that the person requesting the certificate has authority to do so. The CA typically verifies these facts against official records and by contacting the organization directly. The process takes longer and costs more than the other two levels.
How the Browser Display Changed
For years, EV certificates were visible in the browser. The address bar turned green and displayed the verified company name, which gave visitors a clear signal of extra verification. Several studies suggested that many visitors did not notice or act on that signal, and browsers began removing the special treatment.
Major browsers no longer show the green bar or the company name for EV certificates. The organization details still exist in the certificate, and anyone who inspects it can read them. Because of this change, the most visible benefit that many people associated with EV has largely gone.
When the Extra Vetting May Matter
Whether an EV certificate is worth it depends on what the site needs to prove. For a small blog or an informational site with no sensitive data, DV is usually enough. For a large organization whose customers submit personal or financial details, or whose contracts require a verified identity, the extra vetting may be useful. Some paid certificates also include a warranty, which is explained in what an SSL warranty covers, and the broader comparison of free and paid certificates is a useful next step.
EV has limits, though. A phishing site can obtain a DV certificate, and the padlock will still appear. EV does not stop fake sites, and it does not guarantee that a business is trustworthy. Owners should weigh the cost of the certificate against the value of a stronger identity record, and against the other trust signals they already provide.
Frequently asked questions
Is an EV certificate more secure than a DV certificate?
The encryption is the same. EV adds stronger checks on the organization, which makes it harder for an unverified company to receive an EV certificate. It does not make the connection more heavily encrypted, and it does not stop phishing sites that use DV certificates.
Do EV certificates still show a green address bar?
No. Major browsers have removed the green address bar and the company name display for EV certificates. The organization name is still stored in the certificate and can be viewed in its details, so the information is still present even though it is no longer highlighted.