7

Years ago (~2010-2019) the Extended Validation (EV) Certificates made a lot of sense. The user in their browser would see a clear difference between

  • a "grey" (http/not secured) website
  • a "green lock" (https normal certificate) website
  • and a "green lock with name of the company owning the website" (https ev certificate) website.

Back then having such a certificate meant that normal users would have a clear indication they are actually connected to the website they had in mind.

Today (~2021) in Chrome I no longer clearly "in your face" see the difference anymore between a website with a normal certificate (like my homepage) and a website with one. Knowing their existence I actually had a hard time finding a website that still has one.

So my question is in general: If there still any value for any website to have an EV certificate?

An EV certificate enter image description here

2
9

If there still any value for any website to have an EV certificate?

Effectively, no, since most browsers now treat them the same as non-EV certificates.

Since fall 2019, the green bar and company information has been removed from all major browsers, such as Google Chrome, Mozilla Firefox, and Microsoft Edge (with Apple’s Safari browser having removed these indicators even earlier). (ssls.com)

If the difference isn't presented to the user, is there really a difference?

As you've shown, there is more information presented when you click through to an EV certificate, but how often will an end user click through? How many end users will understand that seeing the company name there implies anything different about the trust level of the certificate? The decision to bury this information has devalued it, and we will see less sites investing in an EV certificate as a result.

1
  • 1
    It's very much disappointing. At their very end I finally learned they had a really good use, because it's impossible to issue an EV cert off a private root even if the browser trusts the root, because no browser would trust the EV bits of a locally trusted root. – Joshua Feb 11 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.