Why Pay More for an Extended Validation SSL Certificate? An Honest Deep-Dive

The green address bar is gone. Chrome removed it in 2019. Firefox followed. The most visible feature of Extended Validation SSL certificates, the one that justified the premium price for most buyers, disappeared because Google’s security team concluded the EV UI did not protect users as intended. User research showed that most visitors either did not understand what the green bar meant or did not notice it at all.

That removal reopened a question the industry had considered settled: why pay significantly more for an EV certificate when the main visible benefit is gone? The honest answer has two parts. Some of EV’s value was always marketing and visual theater, and that value did largely evaporate with the green bar. But some of EV’s value is structural and technical, operates independently of browser UI, and remains intact. Which part you pay for depends on who your users are, what your regulatory obligations are, what fraud risks you face, and whether anyone in your ecosystem is checking certificate identity programmatically.

This guide covers the full picture: what EV actually verifies, what happened to browser UI and why, the real threat model EV addresses (which is not encryption strength), the honest counterarguments, the impact of shrinking certificate validity periods on EV operations, and a framework for deciding whether EV is the right certificate for a specific use case.

What Extended Validation Actually Verifies: The Rigorous Identity Check

The difference between DV, OV, and EV certificates is entirely in what the Certificate Authority verified before issuance. All three produce certificates that encrypt connections with the same strength. The encryption is identical. What differs is the identity assurance.

The EV verification process is the closest a CA gets to a notarized business identity check. For a typical EV issuance, the CA contacts the organization through independently verified channels (not through contact information the applicant supplies), confirms the legal entity in government business registries, verifies the requestor has authority to act for the organization, and checks for any legal disputes or issues that would affect the certificate’s legitimacy. This cannot be automated. It requires human CA staff performing manual verification steps.

The EV verification process creates an evidentiary record: the CA documented that a specific legal entity, verified against official records, operated this domain at the time of issuance. This record has value in contexts beyond browser UI: audit documentation, regulatory compliance, partner due diligence, and legal proceedings. An OV certificate confirms a business exists. An EV certificate confirms the specific legal entity identity with a verified paper trail.

The Green Bar: What It Was, Why It Was Removed, and What Replaced It

From 2007 to 2019, browsers displayed a green address bar for sites with EV certificates. The address bar turned green and showed the organization’s legal name alongside the URL. Internet Explorer introduced this indicator in 2006 before EV was formally standardized. Chrome, Firefox, and Safari followed. For over a decade, the green bar was the visible return on the EV premium price.

Google removed the EV UI indicator from Chrome in version 77, released September 2019. Mozilla removed it from Firefox in version 70, released October 2019. Safari had already been deprioritizing the display in earlier versions. The stated reasons from the Chrome security team were precise: their research showed the EV UI did not protect users as intended. Users did not make different security decisions when EV indicators were present versus absent. A significant majority of users did not understand what the green bar signified, even among those who noticed it.

Security researcher Ian Carroll reinforced this conclusion with a practical demonstration: he registered a legal business entity named Stripe Inc in Kentucky (the payment company Stripe is incorporated in Delaware) and obtained an EV certificate for a domain displaying Stripe, Inc (US) in the green bar. The legal entity check is real but covers only the legal name and jurisdiction; it does not prevent a lookalike company from legitimately obtaining an EV certificate with a misleading name. This demonstrated that the green bar gave users false confidence in scenarios where determined attackers could still exploit the system.

EV certificate information did not disappear from browsers entirely. It moved from the address bar to the certificate details panel. In Chrome, clicking the padlock and selecting Certificate is valid shows the full EV details including the Subject organization name, jurisdiction of incorporation, and certificate serial number. The information is still there; it is no longer surfaced to users who do not specifically look for it.

The Phishing Landscape That Makes Validation Level Matter

The padlock icon in a browser’s address bar was originally a trust signal: a site with HTTPS has a certificate and the connection is encrypted. By 2019, over 70% of phishing sites were using HTTPS with valid certificates. By 2025, that figure exceeds 90%. The padlock no longer means the site is safe; it means the connection is encrypted. Safe and encrypted are different properties.

How do phishing sites obtain valid SSL certificates? Easily. Let’s Encrypt issues free DV certificates to any domain that passes an automated HTTP-01 or DNS-01 challenge. The challenge verifies only that the applicant controls the domain. It verifies nothing about whether the site behind that domain is legitimate. A phisher who registers paypa1.com or amazon-security-check.net gets a free DV certificate with a padlock in minutes. The padlock appears. The visitor assumes safety.

OV and EV certificates cannot be obtained for impersonation the same way. A phisher trying to obtain an OV certificate for a site claiming to be Amazon would need to present a registered business named Amazon to the CA’s verification process, which would require the actual Amazon or a fraudulently registered entity with that name, both of which are difficult. EV raises this bar further: the legal entity must be verifiable in official government business registries, and the CA must independently verify the requestor’s authority to act for that entity.

This does not make OV or EV phishing-proof. An attacker who registers a company named Amazon Secure Services LLC and obtains an OV certificate for a convincing domain has bypassed some of the protection. EV adds the requirement that the legal entity name and domain must both be verified, making typosquat-plus-fake-company attacks more difficult but not impossible. The protection is probabilistic and raises attacker cost; it is not a hard barrier.

The practical phishing protection of EV is that it is more difficult and expensive to impersonate a legitimate EV-holding organization than one holding only a DV certificate. A sophisticated attacker with resources can still impersonate through other means: typosquatting with a similarly named company, subdomain attacks, or social engineering. EV should be one layer in an anti-phishing strategy that also includes domain monitoring, Certificate Transparency alerting, DMARC email authentication, and employee awareness training. It is not a standalone phishing prevention tool.

EV’s Hidden Value: Machine-Readable Identity That Browsers Do Not Show You

The most underappreciated aspect of EV certificates is their value to systems rather than to individual human users. While browsers no longer display the green bar to visitors, the EV certificate’s identity data is read and used by fraud detection systems, payment processors, API security systems, partner due diligence processes, and regulatory audit trails.

Fraud detection and payment systems

Payment processing fraud detection analyzes hundreds of signals about every transaction. Certificate type is one of those signals. A payment page presenting an EV certificate provides a stronger identity assertion than one with a DV certificate. Chargeback systems and fraud detection algorithms that consume this data have more identity confidence to work with when EV is present. This does not mean DV sites cannot process payments, but EV-equipped payment pages provide better signal quality to fraud detection infrastructure, which can reduce false positive fraud flags and improve transaction acceptance rates for legitimate purchases.

API and B2B partner connections

When two businesses integrate their systems through APIs, the receiving system validates the certificates presented by the calling system. An EV certificate on an API endpoint provides machine-readable confirmation that the caller is the specific legal entity they claim to be, verified by a CA. For B2B integrations where counterparty identity matters (healthcare data exchange, financial API connections, supply chain systems), EV provides a programmatically verifiable identity chain that OV or DV cannot match. The API client or integration platform can inspect the certificate’s EV fields and confirm they match the expected legal entity before processing sensitive requests.

Certificate Transparency and identity monitoring

Certificate Transparency logs record every certificate issued by publicly trusted CAs. EV certificates in CT logs include the verified legal entity name. Organizations that monitor CT logs for certificates issued for their domain or their organization name receive higher quality alerts from EV: the log entry confirms the legal entity, not just domain control. This makes it easier to detect unauthorized certificate issuance impersonating the organization, because any certificate issued claiming to represent the legal entity but not obtained through proper EV verification would be detectable through the mismatch between the claimed organization name and the actual issuing entity’s verification records.

Regulatory compliance and audit documentation

In regulated industries, security controls must be documented and evidenced. An EV certificate in scope creates an audit trail: the CA’s verification record confirms the legal entity’s identity was independently verified at issuance. For organizations subject to PCI DSS, HIPAA, SOC 2 Type II, ISO 27001, or financial regulatory frameworks, EV certificates on systems handling sensitive data provide documented identity assurance that DV certificates cannot. Auditors reviewing security controls can inspect the certificate, confirm the EV fields, and trace the verification back to the CA’s records. This is audit evidence with provenance.

The Honest Counterarguments: When EV Is Not Worth the Premium

A complete analysis of EV’s value requires addressing the cases where the premium is not justified. Not every organization benefits from EV, and the CA vendor position of recommending EV broadly does not serve every buyer’s interests.

When DV or OV is sufficient

A personal blog, a portfolio site, a developer’s project, an internal tool, or any site where the primary need is encrypted transmission benefits fully from a free DV certificate. The encryption strength is identical. The padlock appears. HTTPS is active. There is no user-facing benefit from EV on a site whose visitors would not know or check what legal entity owns it.

A small or medium business that does not operate in a regulated sector, does not process high-value financial transactions, and does not have B2B API integrations that require EV-level identity verification gains marginal benefit from EV over OV. OV confirms the business exists and provides some phishing resistance without the EV premium and validation timeline.

The company registration cost argument

In some jurisdictions, registering a legal business entity costs less than an EV certificate. An attacker with sufficient motivation can register a company with a name similar to their target, obtain an EV certificate for a lookalike domain, and present a technically valid EV certificate for a fraudulent site. The legal entity name in the certificate would be the attacker’s registered company name, not the target’s. The CA’s verification checks the legal entity against official records but cannot prevent a determined attacker from registering a fraudulently positioned company.

This is a real limitation. EV raises attacker cost and requires more effort than a DV phishing site, but it does not raise an insurmountable barrier for well-resourced attackers. The value of EV’s identity verification is in filtering out opportunistic and low-sophistication attacks, which represent the large majority of phishing attempts, not in stopping nation-state-level adversaries.

The 47-day validity problem for EV

The CA/B Forum’s Ballot SC-081v3 (approved April 2025) established a validity reduction schedule: 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. For DV certificates, this drives automation adoption: Certbot and ACME clients handle renewal with no human involvement. For EV certificates, the path to automation is significantly harder.

EV issuance requires human identity re-verification: phone calls to verified numbers, review of legal documents, confirmation of authorized requestors. This process takes three to seven business days and cannot be fully automated. Under 47-day validity, an organization’s EV certificate needs to be renewed approximately eight times per year. Each renewal requires the full re-verification process, human CA staff time, and the organization’s compliance staff time. The operational burden at 47-day EV validity is substantial.

Several CAs are working on persistent validation approaches that cache previously verified organizational data and reduce re-verification to confirming that nothing has changed. NIST and the CA/B Forum are discussing how to accommodate shorter validity for higher-validation certificates. The problem is real and unresolved as of 2026. Organizations evaluating EV should explicitly model the renewal operations burden under current validity periods and under the 47-day schedule that takes effect in 2029.

The 47-day validity challenge may rebalance the EV market. Organizations in regulated industries that need EV’s identity assurance will continue using it and will need to invest in renewal automation or accept higher operational costs. Organizations that adopted EV primarily for the green bar (which is gone) will have less justification to absorb the operational burden. The net effect may be that EV becomes concentrated in sectors where it provides genuine risk and compliance value rather than broadly used as a premium marketing signal.

What the EV Verification Process Involves: What You Are Actually Paying For

Understanding what happens during EV verification helps calibrate the value. The CA/B Forum’s EV Guidelines define the specific checks required. This is not a marketing description: it is a defined standard that CAs must follow.

• Legal existence: The CA verifies the organization is registered as a legal entity in its claimed jurisdiction using official government registry records. A company that exists only on paper and has no official registration cannot obtain an EV certificate.
• Physical existence: The CA verifies the organization has a physical address in the jurisdiction claimed, not just a registered agent address or PO box.
• Operational existence: For most EV guidelines, the organization must have been operational for a minimum period (typically three years, though some CAs have shorter requirements) and must not be dormant or dissolved.
• Domain authorization: The organization must prove it controls the domain for which the certificate is being issued, with additional confirmation that the domain is legitimately associated with the organization.
• Authorized requestor: The CA independently contacts the organization through a verified telephone number from a public directory (not from information provided by the applicant) and confirms that the specific person requesting the certificate has authority to do so on behalf of the organization.
• Cross-checking: The CA checks multiple independent sources (government records, commercial directories, legal entity registries) and must resolve any inconsistencies before issuing.

This process is why EV costs more and takes longer. Each verification step requires CA staff time and cannot be automated. The certificate issued at the end is a documented artifact of this verification, with all findings recorded in the CA’s issuance records.

Decision Framework: Is EV the Right Certificate for Your Organization?

The answer depends on four factors. Apply these in sequence.

Frequently Asked Questions

Is an EV SSL certificate still worth it after the green bar was removed?

For specific use cases, yes. For others, less clearly. The green bar’s removal eliminated EV’s primary visible user-facing value, but EV’s structural value remains: verified legal entity identity in Certificate Transparency logs, stronger phishing resistance against brand impersonation (attackers must register and verify a legitimate legal entity, not just control a domain), machine-readable identity in fraud detection and API security systems, and documented audit evidence for regulatory compliance. Organizations in regulated industries, high-value targets for impersonation, and B2B environments where certificate identity is programmatically verified still derive genuine value from EV. Personal websites, blogs, and small businesses without regulated data handling do not need EV.

Why do over 90% of phishing sites now have HTTPS?

Because obtaining a DV certificate is free, automated, and takes minutes. Let’s Encrypt and other CAs issue DV certificates to any domain that passes an automated domain control check. The check confirms only that the applicant controls the domain; it does not evaluate whether the site is legitimate or malicious. A phisher who registers a convincing lookalike domain gets a valid DV certificate with a padlock immediately. The padlock, which used to signal safety, now signals only that the connection is encrypted. It no longer distinguishes legitimate from phishing sites. This context is why validation level matters: DV provides only domain control verification, OV adds business identity, and EV adds full legal entity verification.

What happens to EV certificates under the 47-day validity rule?

From March 2029, all TLS certificates including EV must have a maximum validity of 47 days. This means approximately eight renewals per year. EV renewals require full legal entity re-verification by CA staff, which takes three to seven business days and cannot be fully automated. Organizations using EV at 47-day validity face either accepting high operational overhead or working with CAs that implement persistent validation frameworks that reduce re-verification to confirming that previously verified information has not changed. CAs and the CA/B Forum are developing these approaches, but the operational challenge is real. Organizations evaluating EV should include renewal operational cost in their 2029 planning.

Can a phishing site obtain an EV certificate?

With effort and resources, yes. An attacker can register a legal business entity with a name similar to a target brand in a jurisdiction with low registration requirements, and obtain an EV certificate for a lookalike domain. The EV certificate would be technically valid: the CA verified a real legal entity. The protection EV provides is raising the attacker’s cost and complexity well above the level of opportunistic phishing attacks, which overwhelmingly use free DV certificates. Sophisticated, well-resourced attackers targeting specific high-value organizations could potentially bypass EV’s protections. The value is in filtering the vast majority of phishing attempts, not in stopping nation-state-level adversaries.

What does an EV certificate actually say in the certificate details?

An EV certificate’s Subject field includes the organization’s verified legal name, the jurisdiction of incorporation (state and country), and a registration number from the relevant business registry. It also includes the organizationalUnitName fields specific to EV and the Certificate Policies extension containing the CA/B Forum EV OID (2.23.140.1.1). You can view all of this by clicking the padlock in Chrome, selecting Certificate is valid, going to the Details tab, and examining the Subject fields. Compare this to a DV certificate, where Subject contains only the domain name, and an OV certificate, where Subject contains the organization name and country but without the full EV identity fields.

Is OV a reasonable middle ground between DV and EV?

For many organizations, yes. OV confirms that a registered business controls the domain, which provides more identity assurance than DV and prevents the most basic phishing scenarios (a phishing site cannot easily obtain an OV certificate claiming to be a specific registered business without presenting verification documents for that business). OV does not provide the full legal entity verification trail of EV, does not trigger EV-specific fields in fraud detection systems, and does not carry the audit provenance of an EV certificate. For regulated environments and high-value fraud targets, OV is insufficient. For small to mid-size businesses without regulated data or significant impersonation risk, OV represents the appropriate balance of identity assurance and operational simplicity.