14

While visiting some https websites (like online banks, etc) url string appear to have little extra green box on the left hand side, with some organisation details.

While other https websites just show a padlock

see example pic. ssl

Why is that, and whats the difference.

|improve this question
23

The basic distinction is between a certificate verifying control of a domain, and a certificate verifying the real-world entity behind the domain. With a standard SSL certificate, all that's verified is that the entity with the certificate legitimately controls that domain. It doesn't mean that that's the entity I think it is; I could register bankofamerica.co, and I can then legitimately get a domain-validated certificate for it, and that would show up as a green lock in browsers.

What that box indicates is that CAs have done more validation; EV certificates (the green box) generally require actually verifying the existence and name of the business requesting them. I could not get an EV certificate for that site that says "Bank of America" on it, because I don't have a company called Bank of America, and even if I did the actual person reviewing an EV cert application (unlike normal certs, EV certs aren't automated) would likely be somewhat suspicious at someone claiming to be a bank.

So that's the stated role of EV certs: Verifying that the server sending you a webpage is the correct server for that domain doesn't really help unless you also know that the domain is owned by the company you want to interact with. With Google and Facebook, you know already that their websites are google.com and facebook.com, so I know that I want to talk to google.com, and if I'm talking to the real google.com that's enough. With other organizations, it's not necessarily enough to know I'm talking to the real so-and-so.com; I also need to know so-and-so.com is the actual website I want to be talking to.

|improve this answer
  • Might be worth adding an explicit statement that "EV" stands for "Extended Validation", and there are guidelines for them defined by the CA/Browser Forum, so CAs and browser manufacturers agree what is meant. en.wikipedia.org/wiki/Extended_Validation_Certificate – armb Mar 13 '15 at 14:10
6

CAs (Certificate Authorities) charge extra fees for the "shiny green boxes" because they lead website owners/operators to believe that if your site has the best "shiny green box" then your visitors will trust you more. This propaganda tactic has generally been working very well for Certificate Authorities as people really do believe that the bigger the green box is the safer the website is.

This has lead to an alternative initiative that you can read about here: https://www.eff.org/deeplinks/2014/11/certificate-authority-encrypt-entire-web

and here: https://letsencrypt.org/

The security of an SSL with "no green box" vs one with a "small green box" or one with a "shiny green box" or even a "large shiny green box" is all basically the same from an encryption standpoint. The encryption is possibly exactly the same level between any two variants (although some might be different, there is an accepted minimum). So in the end, what type of green box a website has depends on how much paperwork an applicant is able to give the CA (to prove they are who they say they are) as well as how much money they wanted to pay a Certificate Authority (for the shiny) in effort to give visitors the facade of a higher level of security when in fact the encryption is equal and it is effectively a guarantee that money was paid, paperwork was filled out, and limited monetary guarantees were awarded for the website.

Note: Self signed certificates are known to be risky and your browser will give you a very clear warning when attempting to view a website that has one. Because of this warning, self signed certs are generally only used for testing and personal purposes, but your mileage may vary.

|improve this answer
  • 1
    -1 - This is wrong. Self-signed certificates will present a scary dialog "Don't trust this connection". The no green box is for regular CA signed class-1 certificates. This validates that the owner of the certificate also controls the domain. (E.g., you bought example.com and can receive emails at admin@example.com). The certificates with the large green boxes are the extended validation certificates which verify that a domain belongs to a real life organization (and the green box displays what organization). – dr jimbob Mar 12 '15 at 16:50
  • 6
    The benefit of EV certificates is they do fact checking. So if an attacker manages to get a domain like thepaypal.website, the attacker could get regular class-1 SSL certificates for it, but not EV ones as they would not be able to prove they are legal identity paypal. – dr jimbob Mar 12 '15 at 16:54
  • yes, there are different levels of fact checking which result in different levels of how fancy looking your green box will be. But that fact checking is to make sure that an applicant is who they say they are. The difference is still a matter of how much money you pay and how much paperwork you do (which is indeed a form of security), but the encryption itself is not any different which is the main point of my answer. I will edit my answer to reflect the added fact checking needed for (what I like to call) "fancier green boxes". – KnightHawk Mar 12 '15 at 17:15
  • Since you mentioned encryption, the self-signed certificates are as good as any others. They raise alerts from the browser (which expects to have an authoritative chain in order to let you go transparently forward) but the certs themselves are the same. – WoJ Mar 13 '15 at 13:14
  • 1
    @HagenvonEitzen: a self-signed certificate, encryption-wise is perfectly good. It is an X.509 certificate, as valid an any other. trust-wise, this may be a problem. If you expect to see a self-signed cert then this is no problem, if not - it is. Since the vast, vast majority of certificates users will see in their browser are attached to a chain, they warn the users of "danger" in the "better sorry then worry" philosophy. – WoJ Mar 13 '15 at 15:33
3

When webmasters buy an SSL cert. They have the option to purchase extended validation certificates.

For IE, it would turn the address bar green, in Chrome it would show a green box before the URL of the site.

The main point of showing that green bar is to prove that the website is run by the people they claim to represent. In order to purchase an extended validation SSL certificate, most CA verify the legal, physical, and operational existence of the business. Here is a snippet from Digicert's website.

When validating a website for an EV certificate, DigiCert complies with a process that is strictly defined by the CA/Browser Forum. In fact, DigiCert is a founding member of the CA/Browser Forum.

As part of the process, one of our validation specialists contacts the requesting organization to confirm that they requested the certificate and that the applicant is authorized to receive the certificate on behalf of the organization. By maintaining this human element in the validation process, fraudulent or phishing-related activity is much easier to detect.

Our process includes:

  • Verifying the legal, physical, and operational existence of the entity.
  • Verifying that the identity of the entity matches official records.
  • Verifying that the entity has exclusive right to use the domain specified.
  • Verifying that the entity has properly authorized the issuance of the certificate

Source: https://www.digicert.com/ev-ssl-certification.htm

|improve this answer
  • then why doesn't google and/or facebook have these kind of certificates? clearly it's not the matter of extra cost for a certificate – dark_ruby Mar 12 '15 at 15:20
  • 4
    @dark_ruby because it's kind of a racket... They're paying more for a cert that has extra assurance that the CA did their job right. That's as opposed to a regular cert, which is just regular assurance that the CA did their job right. If you can't trust the CA to do their job right, then what does that extra buy you? – gowenfawr Mar 12 '15 at 15:27
  • @dark_ruby: for companies like Google, EV can become a matter of cost. Google load balances to data centers all over the world and have hundreds of domain names, for each country TLDs and misspellings. Thus, keeping private key secure is harder for them. To counteract this, Google uses individual certificates for each data center, unusually short certificate expiry, and rotate their certificates frequently. – Lie Ryan Jun 24 '16 at 6:07
  • @dark_ruby: Another unique reason for Google is that most people interacts with them via browser search bar, rather than by gasp clicking random search result in some search engine. Google having their domain name anchored in the browser's default search bar is, trust-wise, not that much of a difference than them essentially being a CA that can only issue for themselves (which they are). And Google is also default pinned in many browsers. This all means that, for Google, there's very little additional value EV gives. – Lie Ryan Jun 24 '16 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.