3

where exactly is the difference in validation between OV and EV?

both types of certs validate that a company exists in some way and that's pretty much it.

I mean point 2.1.3 explicitly states that it EVs are not vouching for

  • that the company is active
  • that it is legal
  • that it's trustworthy
  • that it's safe to do business with it

and the only primary purposes are:

  • Identify the legal entity that controls the site
  • enable encrypted communications

isnt this pretty much the same what OVs do?

going from that the green bar is the only reason why somebody should get the EVs.

but why do EVs get the green bar, while OVs dont? wouldnt it make more sense to abolish EVs and make all OVs green?

by the most part I have read the only real differences are the green bar and most importantly the price.

Are there any difference between OVs and EVs that I have not seen yet?

3

As the name implies, Extended Validation certificates require a much more rigorous verification requirements than OV. While you're correct that the CA isn't guaranteeing the legality of the site, they are vouching for (11.1.1.) much more than they would be in the OV case.

  1. Verify Applicant’s existence and identity, including;
    • (A) Verify the Applicant’s legal existence and identity (as more fully set forth in Section 11.2 herein),
    • (B) Verify the Applicant’s physical existence (business presence at a physical address), and
    • (C) Verify the Applicant’s operational existence (business activity).
  2. Verify the Applicant is a registered holder, or has control, of the Domain Name(s) to be included in the EV Certificate; EV Guidelines, v. 1.6.2 15
  3. Verify a reliable means of communication with the entity to be named as the Subject in the Certificate;
  4. Verify the Applicant’s authorization for the EV Certificate, including;
    • (A) Verify the name, title, and authority of the Contract Signer, Certificate Approver, and Certificate Requester,
    • (B) Verify that a Contract Signer signed the Subscriber Agreement or that a duly authorized Applicant Representative acknowledged and agreed to the Terms of Use; and
    • (C) Verify that a Certificate Approver has signed or otherwise approved the EV Certificate Request

While 11.1.1.(1)(C) might seem to be a contradiction with the exclusion for the company's activity, it means that the entity was active at the time of application for the EV certificate, though the CA cannot guarantee that the entity is still currently active.

11.14.3. Specifies that the CA cannot use data older than 13 months to support issuance of certificates, and EV Certificates have a maximum lifetime of 825 days (and as of 1 March 2018 all certificates will have this maximum). Thus, an EV certificate certifies that the entity was active within 13 months of the issue date and it will be trusted for a maximum of ~27 months from that date.

Each of the verifications above is also more rigorous; for example:

11.2.2 (4) Principal Individual: A Principal Individual associated with the Business Entity MUST be validated in a face-to-face setting.

The description of the requirements for this face-to-face validation goes on for a full page.

  • but the intresting thing is that point 1C of what you listed directly contradicts the excluded purposes. isnt that a bit weird? – My1 Sep 22 '17 at 13:18
  • 1
    I've expanded my answer to include discussion about the apparent contradiction – Matt Slonetsky Sep 22 '17 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.