Note: I work for CertSimple, which specialises in verifying site owners for EV certificates.
The answer is no. Google does not currently use Extended Validation certificates. Apple, Microsoft, Twitter, GitHub and most banks do. Google does not.
Why doesn't Google use an EV certificate?
Google does include a verified legal identity in their certificates - the
google.com certificate is an OV certificate, which, like EV, asserts Google Inc as the owner of the public key in the certificate - thanks @lie-ryan for noticing this. OV is a predecessor of EV, but does not show any visual indicators of the identity to the end user.
I run a company that specialises in EV. Having had many conversations with Google staff about EV (and having some idea of the culture from having worked for Google in the past), the answer is typically one or more of the following:
- Google's own certificates are checked by Chrome itself. Unless your Chrome binary is altered it's very unlikely you'll see a fake Google certificate.
- Until recently it was difficult to get a working SSL cert for google.com.mg or google.com.im, as even domain validation CAs would do some minimum work to check for well known companies when issuing certs. This has changed as CAs now entirely automate the process and do not perform any more validation work than what the baseline requirements include.
- Inertia: Google's original certificate was issued when 90's era background checks were replaced by domain validation by the CAs.
- Requirements for wildcard certificates - EV requires all domains be verified by the CA and included in the certificate as SANs. While the cost wouldn't be an issue (Google run their own CA), the change in process would.
Belief that end users will notice the difference between DNS domains. Imagine the following sites pop up in your browser:
If it wasn't obvious, A, C, D and F are controlled by Google Inc, B and E not.
Belief that EV background checks are is slow, painful and expensive. This is true, though we are working on addressing this.
- Google does not have any data on the effectiveness of Chrome's EV UI and is this unsure of how effective it is.
- The CAs have behaved incredibly poorly in the past - companies selling IE5 support until 2015, 'seal in search' injects logos into Google search results pages, Symantec's 2015 miss-issuance and subsequent non audit. Many of these things are profoundly user-hostile. As a result, there is mistrust between the browsers and CAs and even things that are pro-user, such as helping Alice connect to
Bob's Bank Inc get caught up in the friendly fire.
- Due to to the AMP project hosting content on google.com for prefetching purposes, a lot of full-page content not controlled by Google is now hosted on google.com. This includes phishing content (specifically, fake Google oauth pages). Having an EV certificate for a site with user generated full-page content could harm users.
Responding to the inaccuracies of the current answer
Google wants added security in a technical sense, not visual cues.
Extended Validation is not added security by visual clues: it is added security by background checks, which assert the connection between a legal identity and a public key.
HSTS and HPKP keep users safe from all known attacks other than a local system compromise
This is incorrect. EV puts a legal entity inside the certificate, in the
jurisdictionOfIncorporatedName fields. These are then shown to the browser. If someone registers yourbank.com.mg, or yourbank.com.im, or any other domain they will be able to get a 'domain validated' certificate. However they will have a much harder time passing the EV background checks. HSTS and HPKP will not prevent the browser from connecting to the fake site.
instead Google created HSTS and HPKP
This is incorrect. HSTS, HPKP and EV serve different purposes: HSTS prevents protocol downgrade attacks, key pinning prevents certificate misissuance, EV provides association of a legal entity to the certificate. These are different goals and a solution to one categorically does not help with the others.
EV is marketing. It doesn't provide anything.
This is incorrect. From the EV guidelines
The EV Certificate Warranties specifically include, but are not limited to, the following:
(A) Legal Existence
(C) Right to Use Domain Name
(D) Authorization for EV Certificate
(E) Accuracy of Information
(F) Subscriber Agreement
Note that domain validated certificates do not assert any connection between a certificate and a legal entity. ie, the DV certificate on yourbanklogin.com doesn't make any assertion that the site has anything to do with Your Bank Ltd.
EV signals that the CA claims to have done more work in return
This is misleading: the CA has done more work. Additionally the CA's work is audited for compliance against the EV Audit Criteria Guidelines