Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL?
Also, my provider only allow the EV green certificates to be on the root (no sub domains or wildcard *. allowed). Is that normal? Can I mix EV green for the root and regular SSL for all sub domains *.mydomain.com ?
Is EV green extended validation slower than a regular SSL?
A EV certificates is just a normal certificate but with a few special issuer specific X509 extensions. The browser compares these extensions against the extensions expected for EV certificates on the issuers CA and if they match it will show the green EV bar.
These special X509 extension are not related to the strength of the certificate and in fact the strength used is the same as with any other modern certificates, i.e. usually 2048 bit with SHA-256 as signature algorithm. This means the time needed for validation of the certificate is usually the same as with other certificates. The only major difference is that browsers usually require a successful revocation check with OCSP when connecting to a site with an EV certificate. And if no OCSP stapling is used this revocation check will result in an additional TCP connection to the OCSP responser which will slow down the initial connection setup.
... my provider only allow the EV green certificates to be on the root (no sub domains or wildcard *. allowed). Is that normal?
The rules for EV certificates are defined by the CA/Browser forum. Thus you will find in section 9.2.3 that wildcards are not allowed:
Wildcard certificates are not allowed for EV Certificates.
I don't see any special rules for sub domains though.
Can I mix EV green for the root and regular SSL for all sub domains *.mydomain.com ?
You could do this in theory. But it would be better to simply include all the hostnames you use into the EV certificate as subject alternative names.
How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL?
EV SSL certificate doesn’t affect on website loading speed and works same as non-EV SSL certificate. In fact all SSL certificates come with same 256-bit encryption and 2048-bit root key encryption, but there are difference between the verification processes which puts assurance to your website and inspires web users to deal with.
When CA receive certificate request from applicant, they will check legal, physical and operational existence of the entity by confirming official records like incorporation and business licensing information and requester has special privileges to use the domain.
Once EV SSL certificate is installed on site, it will enable “Your Company Name in the Green Bar” which is most visible sign of security and authentication and help to identify phishing sites.
Also, my provider only allow the EV green certificates to be on the root (no sub domains or wildcard *. allowed). Is that normal?
All CAs has to follow CA/Browser Forum guideline to issue digital certificate and according rules “Wildcard certificates are not allowed for EV Certificates”.
Can I mix EV green for the root and regular SSL for all sub domains *.mydomain.com ?
You cannot get EV SSL certificate for .mydomain.com, because of asterisk () refers unlimited numbers in wildcard terms.
Solution #1
Some certificate providers enable SAN features and allow adding multiple sites or sub-domains with their EV SSL certificate that you can get EV Multi Domain SSL certificate for your sites or/and sub-domains. At the time of ordering certificate, you need to select numbers of subject alternative names and add specify domains and/or host names.
Solution #2
You can also obtain EV SSL certificate for root domain and wildcard SSL certificate for *.mydomain.com. In that case, you need to manage two individual certificates and green bar will not be enabled on sib-domains.
AFAIK, EV is just a bureaucratic stuff, requiring you to have a physical location, registered name and other things that identify you.
But then, the certificate is the same, so there is no decrease in the performance compared to a regular DV certificate.
How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL?
None at all. EV certificates are technically the same as regular certificates with just a different OID policy number (so browsers can differentiate EV certificates). The main difference for EV is in the identity verification process when you purchase the certificate. An EV certificate tells your users that the CA has verified the certificate holder's identity according to the EV process.
Also, my provider only allow the EV green certificates to be on the root (no sub domains or wildcard *. allowed). Is that normal?
EV CA is not allowed to issue an EV wildcard certificate per CA/Browser EV issuance guideline. EV CA can issue certificate for subdomains, but you'll need to do domain verification for each subdomain. You usually need to buy a SAN/Multi domain EV certificates rather than single name certificate.
Can I mix EV green for the root and regular SSL for all sub domains *.mydomain.com ?
There's technically nothing preventing you from doing that. However, this is often not a good idea if the Wildcard overlaps with the EV. This is because Wildcard certificates are usually deployed on large number of machines and EV certificates are usually deployed on systems with higher security, as systems that require EV are usually your most important system. If the Wildcard are leaked on any of these systems, the attacker would be able to impersonate your EV domain. This may or may not apply to you.
Some certificate providers add the root domain name to a Wildcard as SAN, so that your Wildcard may also be usable for your root domain. You need to be careful when using certificates with different verification levels on your root for this reason.
Extended Validation (EV) certificates are a bad choice for web performance. They have a much bigger negative impact on website speed and reliability than Domain Validation (DV) certificates.
I researched this extensively in Dec 2019/Jan 2020 and just published the results at https://www.aaronpeters.nl/blog/ev-certificates-make-the-web-slow-and-unreliable/. It's a long blog post so perhaps best to read only the first few paragraphs and the follow the link to the Key Insights section.
In summary:
When a browser is establishing a fresh connection to the server, and the server presents an EV certificate, the browser will send a blocking request to the Certificate Authority's server, asking for the revocation status of the cert. This blocking request happens always in Chrome/Edge and almost always in Firefox. This request may take 100ms or much longer and extends the time the website visitor is starting at a blank screen, waiting for the page to load.
Stapling an OCSP response to the EV certificate never prevents this blocking request from happening in Chrome/Edge, but does prevent it sometimes in Firefox.
Compare this to DV certificates: Chrome/Edge simply never send that blocking request and Firefox will also never send it if the certificate is OCSP stapled.
Now ... what if the Certificate Authority's server is down? If you serve an EV certificate to Chrome/Edge and that revocation status check fails, the browser will show an error page to the user. Ouch. Firefox is more forgiving: wait max 10 seconds for a response from the CA and if no response, just continue loading the page.
For optimal web performance, serve an OCSP stapled DV certificate.
