Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Every time an SSL cert comes up for renewal, my provider tries to sell me an Extended Validation certificate. The big difference is the green address bar in FireFox and Safari for quadruple or quintuple the cost.

Supposedly, the benefit (and reason for the green bar not shown in IE8 or Chrome) is deeper authentication of the requesting party. But I can detect little actual difference between Verisign's own minimum requirements (from their CPS) for all SSL certs (section 3.2.2):

At a minimum VeriSign shall:
• Determine that the organization exists by using at least one third party identity proofing service or database, or alternatively, organizational documentation issued by or filed with the applicable government agency or competent authority that confirms the existence of the organization,

• Confirm by telephone, confirmatory postal mail, or comparable procedure to the Certificate Applicant certain information about the organization, that the organization has authorized the Certificate Application, and that the person submitting the Certificate Application on behalf of the Certificate Applicant is authorized to do so. When a certificate includes the name of an individual as an authorized representative of the Organization, the employment of that individual and his/her authority to act on behalf of the Organization shall also be confirmed.

Where a domain name or e-mail address is included in the certificate VeriSign authenticates the Organization’s right to use that domain name either as a fully qualified Domain name or an e-mail domain.

and EV requirements (Appendix F14C):

(C) Business Entities
To verify a Business Entity’s legal existence and identity VeriSign verifies that the Entity is engaged in business under the name submitted by Applicant in the Application. VeriSign verifies that the Applicant’s formal legal name as recognized by the Registration Authority in Applicant’s Jurisdiction of Registration matches Applicant’s name in the EV Certificate Request. VeriSign records the specific unique Registration Number assigned to Applicant by the Registration Agency in Applicant’s Jurisdiction of Registration. Where the Registration Agency does not assign a Registration Number, the Applicant’s date of Registration will be recorded. In addition, the identity of a Principal Individual associated with the Business Entity is verified in accordance with Section 14(b)(4) of the EV Guidelines.

So:

1) Do EV certificates actually inspire more trust among users?

2) Do EV certificates actually help fight phshing/fraud/any of the things vendors list?

3) If they actually performed the minimum requirement, doesn't that include all the EV stuff? What am I missing?

share|improve this question
add comment

6 Answers

up vote 4 down vote accepted

I don't think I've ever seen anything that would be be read by "typical consumers" that touted the benefits of an EV certificate, and I've certainly never heard anyone say anything like "well, I went to site X but they didn't have an EV certificate so I didn't trust them".

I really, really don't think that EV certificates are worth the money.

share|improve this answer
    
I agree, but I hesitate to mark this as my chosen answer without some less anecdotal evidence. –  sh-beta Oct 23 '09 at 17:52
    
Meh, choosing it anyway. Still open to a more complete answer, though. –  sh-beta Oct 26 '09 at 16:52
add comment

Most of the answers here have both sides covered, but I figured I'd chime in (eventhough, as I work for Thawte, I may also be taken "with a grain of salt"). EV SSL works splendidly to solve a very serious problem -- verifying the identity of websites and encrypting connections between them, which cuts down on phishing significantly -- but oddly enough most discussions are less about whether or not it works and more about whether or not people will notice. And due to skepticism surrounding consumers' recognition of the technology, some sites have opted out of EV -- despite the fact that most IT professionals are arguing that widespread encryption will be the only way to maintain a secure internet, and when a good deal of what EV SSL does in the first place is to educate consumers so they can discern between fake and real sites (the green url bar, etc). So it's a catch 22. Consumers will never learn unless they get their hands on technology like EV, and learn that stuff like padlocks and CAs really aren't all that inaccessible to the layman, but since they aren't educated enough to tell the difference at the moment EV is avoided as a money trap. This is a shame, because studies have shown that EV can reduce the amount of abandoned shopping carts and other obstacles to conversion (not only in the VeriSign study but in other independent 3rd party studies). And, of course, everyone needs some kind of encryption.

My advice: most companies offer a 30-day trial of EV or some such. Try it out and maybe run a few casual surveys with your customers to see how they respond. That should give you a better sense of whether or not it's a good investment for you personally.

share|improve this answer
add comment

We purchased an EV cert. I've NEVER had anyone tell me they were glad we had it. I'd be willing to bet that the majority of internet users would enter all of their information on a non-secured site and wouldn't even notice if it was secure or not.

share|improve this answer
    
That's a pretty bold assumption to make. Users are pretty careful when it comes to putting in their details, it's just the many inexperienced Internet users that make it seem like everyone with a credit card is an idiot. –  gekkz Oct 22 '09 at 9:11
2  
You don't support end-users then? ;) –  GregD Oct 22 '09 at 17:24
    
+1 for LOL..... –  ITGuy24 Oct 22 '09 at 19:16
1  
@gekkz: You don't think that "the many inexperienced users" don't constitute a majority? –  womble Oct 23 '09 at 23:20
add comment

The idea was that Certificate Authorities would spend the money you paid for a certificate to make you you actually were who you said they were, by checking official records and fun things like that. They soon realised they could make more money if they didn't do as many checks, and many just check that you can receive email to the domain you're creating a certificate for. Then a bunch of people got together and said "well, you're not really doing the job you were meant to be doing" and the CAs came back and said "well why don't we create EV certificates, which we'll do more rigorous checks on, like we were originally meant to", so now you have standard certificates and EV certificates, which have had more rigorous identity checks performed. The browser makes it clear that these new certificates are different, presumably so people who've bought an EV certificate can feel they've got something worthwhile for their extra money.

But in the end, most people don't have a clue about security or encryption and as long as they see a padlock they assume they're secure. Yes an EV certificate is better, but most people wouldn't know the difference.

For technical people, I think you can consider normal certificates good for encryption only, and EV as encryption with better authentication.

share|improve this answer
    
+1 Just like the rest of the CA business, the EV thing is a ripoff. –  janneb Oct 22 '09 at 8:02
    
I think the high cost of certificates has a benefit, in that it stops casual impersonations. –  David Pashley Oct 22 '09 at 8:31
1  
There is a real value to EV certificates: They actually tell you the real name of the person/entity behind the site you are connected to, versus just making sure you are connected to the URI you wanted to connect to. So, it will e.g. also protect you from mistyping the URI. However, few people understand the distinction. –  sleske Oct 22 '09 at 8:54
    
But EV doesn't seem to do any deeper authentication checking than non-EV - they claim that, but compare sections 3.2.2 and Appendix F14C of verisign.com/repository/CPSv3.8.1_final.pdf and EV is the same thing in different lingo. Moreover, browsers supposedly make the difference clear - but neither IE8 nor Chrome give any visual indication of an EV cert. Firefox and (I think) Safari do, but that's a big chunk of users who don't see anything different. –  sh-beta Oct 23 '09 at 17:51
add comment

I do not think anyone will ever consciously think to mention it to you, but we used to have a lot of customers who would ask us to create private listings on eBay for items because they felt safer doing business there. In reality we've been in business for 15+ years, are nearly the largest vendor in the world for our product, and yet, we have a specialized market and therefore not a lot of recognition with new customers.

The point of an EV is just so that consumers know you're not just some fly-by-night website put up by Joe Conman, but rather, that you're an actual business, doing business in a regular fashion, with known and registered location and identities. That's not a small deal for a lot of people.

Ultimately, if EV works, it'll be somewhat transparent, but it'll mean more people finish their purchases because they feel more secure (and rightfully so).

share|improve this answer
add comment

Well, hard to tell. Probably most users don't really understand the difference to regular certificates, though the green bar will usually be noticed, and some might get a feeling that it is "safer".

There is a study here: http://www.verisign.com/static/040655.pdf on the effects of EV certs on web users. It seems to have a noticeable effect in that study, e.g. 59% of users said they'd become suspicious if a site that used to have a green address bar stopped having one.

However, the study is commissioned by Verisign, so take it with a grain of salt.

I would say that for most people EV probably does not matter, but to those for whom it does, it will be a point in your favor. So if the cost is not prohibitive for you, get one.

share|improve this answer
add comment

protected by MadHatter Sep 25 '13 at 14:17

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.