Extended Validation (EV) SSL FAQ

What is Extended Validation (EV) SSL?

Extended Validation (EV) is a standard, rigorous way of verifying identity information and the authority of individuals who request an SSL certificate. EV was established by the CA/Browser Forum, an association of certificate authorities and web browser vendors.

• Participating certificate authorities agree to follow the Guidelines for the Issuance and Management of Extended Validation Certificates.
• Participating browser vendors have incorporated recognition of EV into their software. When a high-security browser encounters an EV SSL certificate, the address bar turns green and displays the name of the organization and the certificate authority next to the web address.

What does authentication have to do with encryption and SSL?

SSL certificates keep online interactions private when they travel across the public Internet, and they help customers gain the confidence to transact with your web site. When you request an SSL certificate, a third party (such as Thawte) verifies your organization’s information and issues a unique certificate to you with that information. This is known as the authentication process. Learn more: How SSL Works

How does Extended Validation work?

High-security browsers, such as the latest versions of Internet Explorer and Firefox, recognize when an SSL certificate has been authenticated using Extended Validation. In addition to showing https in the web address and a closed padlock icon to indicate an encrypted session, the browser address bar turns green. The name of the organization and of the certificate authority that authenticated the information appears next to the web address. Users can see at a glance that the web site has met the industry’s highest standard for authentication.

Why is a higher level of authentication needed?

Web fraud scams (such as phishing) have become more sophisticated and fake web sites have become harder to spot. With concerns about identity theft and online imposters on the rise, users need to know whether or not to trust a web site. The green address bar is highly visible and assures users that they have reached the correct site and it is authentic.

Why was an authentication standard needed?

Different certificate authorities use different methods to verify information when they issue SSL certificates. Yet all SSL certificates activate the closed padlock and show that encryption is enabled with "s" in "https". To help users quickly determine who a web site belongs to, the CA/Browser Forum established guidelines for rigorous authentication and visibility of that information in the browser.

What types of web sites need Extended Validation?

For public web sites where customers enter credit cards or other high value information, you need to quickly show users proof of your web site’s identity and encryption. Establishing this trust translates into more transactions of higher value for your online business.

Can anyone purchase an Extended Validation SSL Certificate?

Because of the level of proof required by the CA/Browser Forum, organizations must be listed with an official registration agency in their jurisdiction. Corporations, general partnerships, unincorporated associations, government agencies and sole proprietorships may apply if they have a valid license, charter or equivalent verifiable through that registration agency.

The requesting organization may not be located in a country or be part of an industry identified on a government prohibited list. Individuals and unregistered organizations are currently not eligible for SSL certificates with Extended Validation.

What information is verified by Thawte?

Before issuing an SSL certificate with EV, Thawte will verify the organization’s registered legal name, registration number, registered address, physical business address and any assumed business names. Thawte will also verify the applicant organization’s right to use the domain name and that the application organization has authorized the issuance of an SSL certificate with EV.

What information is required for the enrollment process?

Thawte requires a signed acknowledgement of agreement from the corporate contact listed on the order, as well as a legal opinion letter stating that the person requesting the certificate has official authority to obtain and approve an SSL certificate with EV on behalf of the organization. This letter may also include: the physical address of place of operation, telephone number, confirmation of exclusive right to use the domain, and confirmation of an active demand deposit account.

To discuss alternative methods for authentication, contact a Thawte certificate order processing contact in your geographic area.

Why do SSL certificates with Extended Validation take longer to issue?

More robust authentication methods require more time for issuance and may be higher priced to pay for the manual verification of information. However, the more secure your customers feel, the more likely they are to complete their transactions and create accounts on your site. A little extra time and a slightly higher cost may result in a considerable uplift in sales or customer loyalty.

Which SSL certificates have Extended Validation?

SSL Web Server Certificates with EV include Extended Validation, up to 256-bit encryption, the Thawte Trusted Site Seal, free reissues, and a 30-day money back guarantee.

Why choose Thawte?

Thawte is trusted by millions of people worldwide. When we issue an SSL certificate, we know that our name will appear next to yours as the trusted third party who verified it. We take that trust seriously and lead the industry with rigorous authentication methods and a global infrastructure to support real-time certificate look-ups.