Extended Validation Certificates: What EV Really Proves and Whether It Still Matters

Every SSL/TLS certificate on the public web relies on the same family of cryptographic schemes. A domain validated certificate encrypts a connection just as effectively as the most expensive Extended Validation certificate. So if the padlock and the encryption are the same, what does the “Extended Validation” premium actually buy?

The short answer is identity, not secrecy. Extended Validation (EV) certificates do not make a connection more secure at the cryptographic level. They raise the bar on one thing: proving, through a rigorous vetting process, exactly which legal entity stands behind a website. This guide explains what an EV certificate proves, how it compares to other validation levels, why its most visible feature disappeared from browsers years ago, and whether it is still worth paying for. Understanding EV also means understanding how digital certificates establish trust in the first place.

What an EV certificate actually proves

An EV certificate provides the highest level of digital identity assurance available among SSL/TLS certificates. While all certificates confirm to the client that it is communicating with the certificate owner, an Extended Validation of the certificate verifies the legal identity of the website owner to the Certificate Authority (CA).

The CA/Browser Forum, the body that governs these rules, defines the primary function of an EV certificate as being to “identify the legal entity that controls a Web site” and to provide reasonable assurance that the site is “controlled by a specific legal entity identified in the EV Certificate by name, address of Place of Business, Jurisdiction of Incorporation or Registration and Registration Number or other disambiguating information.”

In practical terms, an EV certificate ties four concrete facts to a website:

• The verified legal entity name of the organization that controls the site.
• The address of its place of business.
• Its jurisdiction of incorporation or registration.
• Its registration number (or other disambiguating information).

These certificates are governed by the CA/Browser Forum EV Guidelines, which were established in 2007. That governance is what makes the identity data in an EV certificate consistent and trustworthy across the CAs that issue it.

How EV compares to other validation levels

The most useful way to understand EV is by comparison, because every public certificate shares the same cryptographic baseline. What separates the validation levels is not encryption strength but how much identity the certificate authority verifies before issuing, and how much of that identity is displayed. That verification traces back to the certificate authority that issues and signs it.

At the lowest level, verification confirms only control of the domain. At the middle level, the CA also confirms the legal existence of the organization and includes those details in the certificate. At the highest level, EV, the CA conducts an in-depth review of the organization’s legal, physical, and operational existence, and the request must be initiated by the organization itself rather than by an individual acting informally.

Validation depth	What the CA verifies	What is displayed	Typical use case	Issuance time
Domain control only	Applicant controls the domain	Issuing authority only, no organization details	Personal or internal sites	Minutes
Verified organization	Domain control plus the organization’s legal existence	Organization details in the certificate	Commercial sites that collect user data	Hours to days
Full legal, physical, and operational review (EV)	Legal, physical, and operational existence, plus domain control, initiated by the organization	Verified organization identification details	High-trust, high-risk sites	Longest of the three

The takeaway is that moving up the ladder does not add cryptographic strength. It adds identity assurance and, with it, a higher degree of trust for visitors who take the time to inspect the certificate.

What gets verified during EV vetting

EV vetting is where the premium is earned. Following the CA/Browser Forum guidelines, a public CA validates the operational and physical identity of the organization requesting the certificate. It confirms the legal identity of the site owner, verifies that the applicant is the owner and sole controller of the domain, and confirms that the applicant is authorized to request the certificate on the organization’s behalf.

To establish an organization’s identity and address, a CA does not simply take an applicant’s word for it. It relies on independent, hard-to-falsify evidence, such as:

• Records from a government agency in the jurisdiction where the organization was legally created or recognized.
• A reliable third-party database that is periodically updated and evaluated for accuracy.
• A site visit conducted by the CA or an agent acting on its behalf.
• A formal attestation letter, sometimes supported by documents such as a utility bill, bank statement, or government-issued tax document to confirm an address.

Contrast that with the lightweight domain-control checks used at lower validation levels, where a CA might simply look up a WHOIS record, confirm a DNS record the applicant created, or verify a file placed on the website. Those checks prove control of a domain in minutes. EV vetting, by design, is slower and more thorough because it is verifying a real-world organization, not just a technical relationship to a domain name.

The story of the user interface: from green bar to a plain padlock

For years, the whole point of EV was something a visitor could see at a glance. Prior to autumn 2019, a visitor to an EV-protected website could recognize it by the company name shown in green text, or by a green bar in the address bar that displayed the organization’s legal name and geographic location. It was a visible badge of a verified identity.

Then the badge vanished. Around autumn 2019, both Google Chrome and Mozilla Firefox removed that indicator. Today, every certificate, whether it required minutes or weeks of vetting, displays the same neutral padlock in the browser address bar. Research and industry commentary questioned whether users ever noticed or acted on the green bar, and the browsers moved on.

That change did not remove the EV identity data. It simply stopped surfacing it automatically. To confirm that a site uses an EV certificate today, you click the padlock and inspect the certificate details. An EV certificate reveals the organization’s verified identification information, while other certificate types show only the issuing authority. The information is still there; it just takes a deliberate click to find it.

You can also find this information in the terminal, with tools like openssl

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -text

Scan the output for the X509v3 Certificate Policies extension. An Extended Validation certificate carries the reserved identifier 2.23.140.1.1. Note that this arc is one component shorter than the identifiers used for the other tiers, so read it in full rather than matching on the trailing digits. Any other reserved identifier in that position points to a different tier. Our dedicated page on certificate validation covers what each tier requires of the CA.

Is EV worth it? Weighing cost against benefit

Here is the honest answer: it depends on your risk profile, and for many sites EV is not worth it. EV certificates cost more than other certificates and take longer to issue because of the vetting involved.

Where EV earns its keep is on high-value phishing targets. It is best suited for the kinds of sites attackers most often impersonate: banks, major retailers, financial institutions, and public-facing government entities. More broadly, any site that collects data, processes logins, or handles online payments can benefit from displaying a verified brand identity. If stronger identity assurance and a high level of trust matter to your business, EV has a clear role.

For everyone else, the added cost and slower issuance are harder to justify. It is worth being clear-eyed about what EV does and does not guarantee. An EV certificate proves that a registered legal entity owns and controls the domain. It does not prove that the site itself is inherently trustworthy or well-intentioned. Security researcher Troy Hunt pointed out back in 2016 that the value of EV ultimately depends on the human factor: how much people and organizations understand these certificates and act to protect them. That caveat is the reason EV should be treated as one layer of trust, not a guarantee.

Why EV validation still matters

Even after the browser interface changed, EV validation retains durable value on three fronts.

First, anti-phishing. Phishing sites that impersonate legitimate businesses are a leading vector for stealing sensitive data, and criminals can buy cheap domain validated certificates on dark markets to make fraudulent sites look legitimate. EV makes that harder. Stolen EV certificates are far rarer and much more expensive on those same markets, which raises the cost and effort of a convincing impersonation. By displaying a verified identity inside the certificate, EV gives cautious visitors a way to confirm who they are really dealing with.

Second, verified brand identity. The organization’s identity is embedded in the certificate itself, so the assurance persists regardless of how a given browser chooses to display it.

Third, compliance support. Regulations such as HIPAA, PCI DSS, and GDPR require organizations to protect medical, financial, and personal data. EV certificates help demonstrate that verified identity and strong protections are in place, which can support a successful audit against those requirements.

Automating EV and certificate validation at scale

There is a catch that decides whether EV succeeds or fails in practice: lifecycle management. A certificate’s identity assurance is worthless if the certificate expires unnoticed and takes a service down with it.

Certificate lifespans are shrinking fast. Historically certificates were valid for one to three years. Today the longest allowed lifetime is 200 days, and the CA/Browser Forum has passed a ballot to reduce the maximum lifetime to just 47 days by 2029. Shorter lifespans reflect a broader industry shift toward agility, but they also make manual tracking a genuine liability. Miss a renewal and you risk outages, security gaps, and compliance failures.

EV only delivers on its promise when its lifecycle is enforced without relying on users to remember anything. That is where the Automated Certificate Management Environment (ACME) protocol comes in. ACME automates the issuance, renewal, and revocation of certificates by streamlining interactions between your web server and certificate authorities. Originally developed for Let’s Encrypt, it is now widely supported across CAs and PKI vendors. Automating certificate validation and renewal reduces manual errors, frees up IT resources, and prevents the costly downtime that comes from a missed expiration.

How Keyfactor can help

This is the problem Keyfactor is built to solve. Keyfactor lets you discover, manage, and automate every certificate across your enterprise, so certificate validation and renewal stop depending on individual vigilance. The platform helps teams shift from reactive response to proactive visibility with end-to-end automated public key infrastructure (PKI) and certificate lifecycle management.

That directly addresses the challenges raised above. As lifespans shrink toward a 47-day maximum, automated discovery and renewal keep EV and every other certificate valid and enforced without manual tracking. With ACME support and full lifecycle automation, you can maintain the identity assurance EV provides while avoiding the outages that expired certificates cause.