Chrome does not show green bar with EV SSL but firefox and IE does

Question

I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green padlock and green https:// like you get when you have a standard SSL certificate.

IE and Firefox display the green bar and company name as they should.

Does any one know why I'm getting this issue with chrome?

I have no insecure content on my page, I have run a check with ssllabs.com and the results came back 'B' because

This server does not mitigate the BEAST attack. Grade capped to B

BEAST attack Vulnerable INSECURE (more info)

RC4 Yes PROBLEMATIC (more info)

Does anyone know how I get around this problem? Does this mean that chrome makes more in-depth tests to check whether it's valid, more so than other browsers.

Thanks.

Answer 1

BEAST attack Vulnerable INSECURE (more info)

RC4 Yes PROBLEMATIC (more info)

These warnings are not directly related to your certificate. They're more about your SSL configuration. When a client connects to your server over SSL, the client and server will negotiate which protocols they want to use to exchange keys and encrypt data.

BEAST is a vulnerability with SSLv3 and TLSv1. Basically there's a crypto flaw in SSLv3 and TLSv1 (fixed in TLSv1.1, which isn't widely implemented) that allows a hacker (man-in-the-middle) to attack long running sessions. You can mitigate this issue by configuring your server to use ciphers that are immune to BEAST and to prefer those ciphers.

On nginx the configuration looks like this:

ssl_ciphers RC4:HIGH:!aNULL:!MD5:!ADH:!kEDH;

ssl_prefer_server_ciphers on;

This will use RC4 with clients that support it and fall back to AES.

Answer 2

You can see the same effect on https://www.comodo.com/

They have an EV certificate signed by themselves. Firefox trusts it:

but Chrome doesn't.

Chrome works fine with Verisign:

The problem here is likely that your browser doesn't trust your SSL certificate vendor. It's possible that you have messed up the configuration somewhere (chain certificates can be troublesome) but it will be hard for us to figure that out without you posting a URL here.

Try clicking on the lock then clicking on the Connection tab and then Certificate Information (as I have done in the second screenshot). Hopefully that screen will tell you what Chrome thinks is wrong about your certificate.

The browsers do behave differently with regards to many aspects of SSL/TLS and especially when it comes to EV certificates. Here's one example of them handling revocation differently.

Answer 3

Since the current highest rated answer isn't an actual answer, I'll provide one: Chrome requires Certificate Transparency on EV, Firefox and Edge and Safari do not.

Here's an example SSL Labs scan of a cert that is missing CT: it displays as EV in Firefox, Safari and Edge and as a low-trust DV cert in Chrome:

You can (and should) fix this by talking to your certificate vendor, asking them to include an Signed Certificate Timestamp (SCT) in their certificates using the relevant x509v3 field.