An Extended Validation (EV) SSL certificate represents the most stringent level of validation. In addition to verifying ownership of the domain, the certificate authority checks the organisation operating the website using a detailed procedure governed by the CA/Browser Forum’s specific EV guidelines, and records the result in the certificate.

Even with an EV certificate, the strength of encryption is no greater than that of a domain-validated (DV) or organisation-validated (OV) certificate. The difference lies in the depth of the verification process and the data contained in the certificate.

What does the certificate authority check?

• Legal status: confirmed by official records that the organisation is a registered and active legal entity.
• Physical presence: verifies the address of the registered office or place of business.
• Operations: it verifies that the organisation is actually operational (that it has been in existence for some time, or, for example, that it has a bank account).
• Contact details: the organisation verifies the telephone number using an independent source.
• Applicant’s authorisation: confirms that the person applying for the certificate is authorised to act on behalf of the organisation and that the organisation has approved the application.
• Control over the domain: the same as for other types of certificates.

The EV certificate shows the company’s registration number, country of registration and type of organisation alongside the company name. Due to the verification process, it can take days, or sometimes weeks, for the certificate to be issued.

Why is the green header no longer visible?

A few years ago, browsers displayed the address bar in green, showing the company name, on pages protected by an EV certificate. Browsers phased out this display between 2018 and 2019 (Safari in 2018, Chrome from version 77, and Firefox from version 70), as research showed that users did not pay attention to it and it did not protect them from phishing. Today, a page protected by an EV certificate looks exactly the same in the address bar as any other HTTPS page; the company’s details can be viewed by clicking on the padlock icon and then on the certificate details.

Restrictions

• There is no EV Wildcard. The rules do not permit an EV certificate to contain a name in the format *.pelda.hu that is valid for all subdomains; each protected name must be listed separately.
• Short validity period. The EV certificate is also valid for a maximum of 200 days (since 15 March 2026), 100 days from 15 March 2027, and 47 days from 15 March 2029. The organisation’s verification can be used for a longer period, up to 398 days, but control over the domain must be verified with every reissue.
• It cannot be issued to private individuals, only to registered organisations.

Who should choose this service?

As browsers no longer highlight EV certificates, they do not offer a noticeable advantage over OV certificates for most websites. They may be justified if:

• the contract, policy or order form expressly stipulates an EV certificate;
• The organisation’s internal security policy requires the highest level of authentication;
• would like the registration details to be included in the certificate in a verified format.

In other cases, an OV certificate will already display the company’s verified name on the certificate, whilst a DV or free Let’s Encrypt certificate is sufficient for a blog or a personal website. The article ‘Let’s Encrypt or paid SSL: which should I choose?’ will help you make your decision. If your organisation requires an EV certificate, please contact our support team.