Why does SSL EV certification have a range of encryption (40-128 bit)?

Question

I would like to get SSL-EV certification for my company website. After comparing a list of providers, I am confused by their advertisements.

1. Why do all providers say that their certifications support 40-128 bit encryption? In my mind, it only related to the handshake stage of SSL. It is controlled by Apache/Nginx server. If I only keep 128 bit encryption algorithms in candidate list, there is no way to create a 40 bit SSL connection. What does it matter to the certification?

2. SSL-EV in GeoTrust has lowest price. Does their certification have lower security or credit comparing to Symantec/Verisign?

3. My website is located in China. I heard a rumer "Due to US export rules, if out of USA, in SSL handshake stage, the calculated master key is 128 bit, but only 40 bit is encrypted, the other 88 bit is plain text." Is it true?

4. Is SGC useless? If so, why do the providers still sell them with very high price?

Answer 1

1. Marketing. The providers want you to select them because they list something that someone else doesn't list, even though all certs support the same level of encryption as you noted.

2. Price has nothing to do with security. In fact, all the SSL certificates depend on the lowest level security of any of them.

3. No. The SSL handshake has zero to do with location of either endpoint.

4. SGC is dead. My guess is anyone that needs it for some strange reason (really old legacy applications?) are a niche market. Niche markets have high prices because they can.

5. You didn't ask this, but why do you care about EV? Literally the only advantage of EV is that it gives you a green bar in the browser window. Almost nobody knows what this means.