Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Talking about SSL certificates, there are 3 types.

  • Basic validation
  • Business validation
  • Extended Validation
  • The first one checks only if a domain name is registered for the user which issues the certificate.
  • The second one does also requires information about the company.
  • The last one does check the physicial location of a company.

    My question here, does the 2nd and 3rd option makes the connection more secure? Because our users know the domain is ours (100% verified with them) and they all contain a 128-bit encryption.

Will the 1st certificate be enough for us, or do you recommend the 2nd? I consider number 3 an option for banks.

share|improve this question
1  
I believe there are only two types of validation visible to the user -- basic and extended. Business validation may mean you can put a validation seal on your website, but anyone can fraudulently put up that seal or make up one of their own. Only EV certs give the user a hard to spoof visible confirmation that the site is using an EV cert. "Business validation" seems like it's not worth paying for. Unless you're accepting payment or sensitive personal information, I wouldn't even bother with an EV cert - it doesn't make your site more secure, but gives your users peace of mind. –  Johnny Mar 27 at 22:39

3 Answers 3

They don't make the connection any more secure in terms of the encryption being hard to break, but they do make it more secure in that it is less likely an intruder was able to trick a CA in to issuing a certificate in error.

The level of validation is entirely about earning the trust of your users. Personally, I just do basic validation, but that's just validating to a name or a domain a lot of the time. Knowing that I'm actually talking to the server www.iamevil.com doesn't really help instill confidence. Business validation allows you to have the certificate use the business name and proves that I'm talking to a real organization. Extended validation results in the green bar being presented on most browsers indicating that there is a high degree of trust in the identity of the party they are communicating with.

share|improve this answer
1  
@Rob - the 3rd option is not just for banks. It is for anyone that wants to give their users the most possible trust that they are who they say they are. If your users are all going to know that your domain is actually your domain, you are probably fine with basic, however if you are going to have any walk-ins to your site, having further proven your identity will be beneficial. –  AJ Henderson Mar 27 at 13:37
    
Thanks for clarification, I will accept this answer in a few days if it doesn't get any more detailed explanations. Thanks for your effort. –  Rob Mar 27 at 13:38

As AJ says it doesn't have any impact on the level of encryption but it is intended to protect the trust model underpinning SSL/TLS.

For most sites using SSL, then the overriding consideration is how this is perceived by customers. AFAIK there is no visible difference between the first 2, but EV adds a green thing to your location bar in most browsers. Whether this actually makes a difference to users, I don't know - not suprisingly the CAs claim they do but I've seen little evidence to support this. I remember reading a research paper several years ago where the investigators found that more users thought a site was secure if it contained a picture of a padlock than if it were served up over HTTPS.

Hence the value is in user perception.

This paper from 2007 says that users can't tell the difference, while Geocerts assert that another study in 2007 said it did have an impact.

I'd like to think that users are getting more sophisticated - and therefore this is likely to change over time. But you'll need to bit of a bit of research to device if there's a measurable benefit (or run an A/B test)

share|improve this answer

A less known reason SSL EV is more secure is because SSL EV cannot be spoofed by installing a rogue root CA in the system. The root CAs that are trusted for EV are hardcoded in the browser.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.