1

If I purchase an EV SSL certificate for a site that is using static content from a non-EV SSL site does that effect the EV SSL certificate presentation on the main www site? For example:

www.example.com (uses an EV SSL certificate) static.example.com (uses a standard SSL certificate)

Will users on www.example.com still see the green bar with the company name if the CSS and images are being served from static.example.com?

3

The insecure content blocking functionality is implemented by each browser and not really standardized. However, I do not know of any browser that is doing this.

Browsers display the green bar when the certificate presented has an EV policy OID, which are looked up in a list the browser ships with. I don't know of any browser that implements exceptions to this rule for remote includes from https:// locations without EV, though this isn't to say that in the future nobody will think this is a good idea and implement it.

  • 1
    Opera was at one point at least downgrading EV sites that included non-EV content, but IDK if theyre still doing that or not. – Joe Sniderman Aug 14 '14 at 20:10
  • It's certainly safer to get EV certificates for all your things, for this reason. – Falcon Momot Aug 14 '14 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.