4

I understand SSL is the predecessor of TLS. What about EV SSL? We are using a payment gateway that is rolling out a change soon and will require TLS1.1 or higher. We are currently using a SSL from Godaddy and they said that if we want to upgrade the highest they have is EV SSL. Wanted to understand if EV SSL is equivalent to TLS1.1 or lower.

1
  • 1
    "SSL" is often used as a shorthand to mean "SSL or TLS", or "HTTPS", and that's what's happening here with Godaddy. They're just being a little bit lazy with their terminology. Dec 1, 2017 at 20:32

2 Answers 2

22

I think there's a mismatch in terminology between the SSL/TLS protocol (messages sent over a network) and SSL Certificate Authorities who issue digital certificates to be used with TLS/SSL and / or other crypto protocols.

SSL/TLS

You are correct that SSL is the pre-cursor to TLS. This refers to crypto configuration in your server with higher versions indicating more modern crypto:

SSL 1.0 (obsolete)
SSL 2.0 (obsolete)
SSL 3.0 (mostly obsolete)
TLS 1.0
TLS 1.1
TLS 1.2

These are settings you configure in your webserver, and govern which crypto a browser will use when connecting to your server. You do need a certificate for your server in order to enable SSL/TLS, but for the most part, any certificate you get from a CA can be used with any version of TLS.

SSL Certificate Authorities

A Certificate Authority issues certificates for use with TLS and / or other crypto protocols like S/MIME email, signing PDF documents, etc. Most CAs market their "web server" type certs as "SSL" rather than "TLS" for historical reasons. Most CAs offer various price points of certificate, usually broken into:

Domain Validated (DV)
Organization Validated (OV)
Extended Validation (EV)

This refers to how much time their humans spend doing background checks to ensure that you do in fact own the that web site that you are requesting a cert for. They check things like: can you post a file they provide somewhere on the site? Does the DNS record for that domain list you as the owner? If the DNS record lists a company, are you in fact an employee with authorization to request certificates on behalf of that company? And so on, with DV certs just doing the automated "can you upload a file?" checks, and EV sometimes requiring face-to-face meetings between you and the CA, and original hand-signed documents from the CEO.

Consequently, browsers display bigger, greener lock icons for EV to indicate to users that the browser is extra confident that this is not a phishing site. (EV certs are where you see the legal name of the company as part of the TLS lock icon). Note that bigger greener locks have nothing to do with the type of crypto or version of TLS used.


Bottom line: The level of certificate you buy (DV, OV, EV) and the version of TLS that you configure your server for (SSLv3, TLS1.2, etc) have almost nothing to do with each other. All levels of certificate use the same type of cryptography, and and all certs are compatible with all versions of the TLS protocol.

5
  • 3
    Minor correction: they verify ownership of a domain name not ownership of a web server.
    – kubanczyk
    Dec 1, 2017 at 8:56
  • Is the EV stage where they'll display the name of the company next to the lock symbol in Google Chrome?
    – SGR
    Dec 1, 2017 at 9:10
  • @SGR exactly that. Thats the only real difference
    – mcfedr
    Dec 1, 2017 at 12:48
  • 1
    @kubanczyk if you want to be picky, they verify control of the domain, rather than ownership
    – mcfedr
    Dec 1, 2017 at 12:48
  • 1
    For completeness, the generic name for the certificates being issued is "X.509". As you say, SSL/TLS is one application of these certificates, and has become the colloquial name for them.
    – IMSoP
    Dec 1, 2017 at 14:02
10

They are orthogonal. There are protocols (SSL, TLS) and there are certificates (DV, EV) that are used in the process of connection/session establishment.

An EV or extended validation certificate simply means that your organization has gone through the most extensively currently defined verification process for obtaining an x.509, or SSL certificate. This is in no way related to the SSL or TLS session negotiation and establishment process.

Any type of certificate (domain validated (DV), organization validated (OV), or extended validation (EV), certification may be used to establish an SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, or TLS 1.2 (and soon TLS 1.3) session. Your server configuration will determine which SSL/TLS protocols are supported, not the certificate validation type.

6
  • 1
    In fact "SSL certificate", as well as "TLS certificate" is a misnommer. They should be named X.509 certificates. TLS can work in other ways, without them. SSL certificate authorities are a misnommer as well. Nov 30, 2017 at 23:28
  • @PatrickMevzek As I mentioned in my post. SSL certificate, however, is an accepted synonym, and the more widely recognized term at that. The use of alternative mechanisms for TLS such as PSK are minimal, and not relevant to the question.
    – Xander
    Nov 30, 2017 at 23:39
  • Certificates are still something coming from ISO X.509 world, and not really from the SSL/TLS world where there are only used, and their use became the prevalent one, but they are not originating in the SSL/TLS protocols. If we did not speak so much about "SSL certificates", the OP would not have been confused from the beginning. My comment was to all replies here in fact, just choose yours as you are the first one. Nov 30, 2017 at 23:47
  • @PatrickMevzek I tend to think of "SSL certificate" as a handy shorthand for "X.509 certificate with appropriate key usage extension(s), subject name format, etc for use as a server certificate with the SSL/TLS protocol family." (This is similar to how I use "SSL client certificate", "S/MIME certificate", "code-signing certificate", "CA certificate", etc. -- they're all X.509 certificates set up for certain uses) It seems to me that this is a legitimate (and very useful) shorthand, even though (like any shorthand) there's an opportunity for misunderstanding. Dec 1, 2017 at 17:28
  • Extending my last comment: the good thing about the "SSL certificate" shorthand is that it allows someone to say "We need an SSL certificate for our website" without needing to understand X.509, PKI, or any of the technical details. The bad thing about it is that it allows someone to say "We need an SSL certificate for our website" without having any understanding of X.509, PKI, or... Dec 1, 2017 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.