What is an extended validation certificate?
An extended validation (EV) certificate is a TLS certificate whose owner has been through the most thorough identity vetting public CAs offer. Before issuing one, the CA must confirm far more than control of the domain: that the organization legally exists and is active, where it is registered, its physical address, and that the person ordering the certificate is authorized to do so. The rules come from the CA/Browser Forum's EV Guidelines, first adopted in 2007, and EV certificates carry a standard policy identifier, 2.23.140.1.1, that software can check.
DV, OV and EV compared
| Domain validation (DV) | Organization validation (OV) | Extended validation (EV) | |
|---|---|---|---|
| What the CA confirms | Control of the domain | Domain control plus the organization's existence | Domain control, legal registration, address, operating status and the requester's authority |
| Typical turnaround | Minutes, automated | About a day to a few days | Several days or longer |
| Organization named in the certificate | No | Yes | Yes, with registration number and jurisdiction |
| Wildcards allowed | Yes | Yes | No |
| Cost | Often free | Paid | Highest |
All three use the same algorithms, key sizes and maximum lifetimes. An EV certificate encrypts no better than a free DV certificate; the difference lies entirely in what the CA checked about the owner.
What an EV certificate contains
Beyond the usual hostnames, an EV certificate's subject records the organization's legal name, its registration or incorporation number, the jurisdiction where it was incorporated and a business category. Running openssl x509 -noout -subject against an EV certificate shows those fields, while a DV certificate shows only a common name.
Browsers stopped highlighting EV
EV used to earn a green address bar showing the company's name. Studies found that users didn't notice when it was missing and weren't protected by it, and the displayed name could mislead. In 2017 a security researcher registered a real company called Stripe, Inc. in Kentucky and obtained a valid EV certificate in that name, which looked identical in the address bar to the well-known payment company incorporated in another state. Major browsers removed the special EV display in 2018 and 2019, so EV details now appear only when a user opens the certificate information. Combined with phishing sites routinely using free DV certificates, that is why a padlock means only that the connection is encrypted to whoever controls the domain.
When EV still matters
EV certificates are still bought for compliance, contractual or brand reasons, because the vetting creates a documented link between a domain and a legal entity that some industries and partners require. For most websites, though, DV certificates issued automatically through ACME, kept short-lived and backed by CAA records and Certificate Transparency monitoring, provide the same encryption with far less effort.
Extended validation certificate on the CompTIA Security+ exam
The DV, OV and EV validation levels are taught with third-party certificates under SY0-801 objective 1.3, the cryptographic solutions objective. Wording such as "the certificate must prove the organization's legal identity, not just domain ownership" points to EV, or to OV where lighter vetting is acceptable. "Issued in minutes at no cost through automation" points to DV. Distractors include the claim that EV provides stronger encryption, an EV wildcard certificate, which the rules don't allow, and self-signed certificates.