Cybersecurity glossary
What is an Extended Validation (EV) Certificate?
Learn what an Extended Validation (EV) certificate is, how EV identity vetting differs from DV/OV TLS certificates, and how browser UI changes affect the security value of EV today.
Definition
An Extended Validation (EV) certificate is a publicly trusted TLS server certificate issued only after a Certificate Authority completes a standardized, higher-assurance identity verification of the requesting organization, beyond domain control checks alone.
Why EV certificates were created
Early HTTPS adoption struggled with a trust problem: a padlock showed encryption, but users could not easily tell whether the site belonged to the company named on the page. Extended Validation (EV) certificates answered with stricter organizational vetting and, for years, distinctive browser UI such as a green organization label.
That history still shapes procurement conversations. Understanding EV today means separating identity assurance at issuance time from the encryption quality of the TLS session—and recognizing that browser presentation of EV has largely normalized.
What makes a certificate “EV”
An EV certificate is still an X.509 TLS server certificate. The difference is the validation process the CA must complete before issuance, guided by CA/Browser Forum EV guidelines: legal existence, identity, and authorization checks that go beyond proving control of a domain name.
Applicant requests EV
An organization submits company details and a CSR or automated enrollment request to a public CA.
CA performs extended vetting
Legal, operational, and authorization checks verify the organization according to EV rules.
Domain control is confirmed
The CA also validates that the applicant controls the DNS names to be included.
Certificate is issued and logged
The EV certificate is signed, delivered, and submitted to Certificate Transparency as with other public certs.
Server presents it in TLS
Clients validate the chain and names during HTTPS handshakes like any other server certificate.
UI signals may be minimal
Modern browsers often show a standard secure indicator rather than a special EV chrome treatment.
EV vs OV vs DV
| Type | Primary check | Typical use |
|---|---|---|
| DV | Domain control | Most public websites and automated issuance |
| OV | Organization identity + domain control | Business sites wanting org details in the certificate |
| EV | Stricter organizational validation + domain control | Policy-driven procurements; historically consumer UI differentiation |
What EV does not guarantee
Not stronger crypto by default
Cipher suites, protocol versions, and key sizes determine cryptographic strength—not EV labeling.
Not phishing-proof
Lookalike domains and compromised sites can still deceive users even when TLS is valid.
Not a substitute for HSTS
EV does not force HTTPS or prevent SSL stripping; configure transport security separately.
Not immunity to domain hijacks
If attackers control your DNS, many trust problems remain regardless of prior EV issuance.
Practical guidance
- Prioritize TLS 1.2+/1.3, strong ciphers, correct chains, and HSTS before debating EV vs DV.
- Buy EV only when a regulation, contract, or internal policy explicitly requires it.
- Do not train users to rely on discontinued green-bar cues that browsers no longer show.
- Protect registrar and DNS accounts; issuance quality cannot save a stolen domain.
- Monitor Certificate Transparency for unexpected certificates on your brands.
- Automate renewal carefully; EV vetting timelines can be longer than DV ACME flows.
- Document certificate inventory owners so EV and DV certs do not expire unnoticed.
- Evaluate whether OV identity fields meet stakeholder needs at lower operational friction.
The practical takeaway
An Extended Validation (EV) certificate is a publicly trusted TLS certificate issued after stricter organizational identity checks. It does not magically encrypt better than DV, and most browsers no longer give EV special visual prominence.
Treat EV as an identity-vetting product choice—not as the core of HTTPS security. Modern transport safety comes from sound TLS configuration, certificate lifecycle operations, and protection of the domain control plane.
Related security terms
X.509 Certificate
The certificate format used for EV and other public TLS credentials.
Certificate Authority (CA)
The issuer that performs EV vetting and signs the certificate.
HTTPS
The user-facing encrypted web protocol that presents TLS certificates.
Certificate Transparency
Public logging that applies to publicly trusted certificates including EV.
Frequently asked questions
What is an EV certificate in simple terms?
An EV certificate is an HTTPS certificate that a CA issues only after verifying the organization’s legal identity more thoroughly than for a basic domain-validated certificate.
Does an EV certificate encrypt better than DV?
No. Encryption strength depends on TLS configuration and key algorithms, not on EV versus DV validation type. EV is about identity vetting, not stronger ciphers.
Do browsers still show a special EV UI?
Most major browsers removed prominent EV indicators such as the green organization name in the address bar. Users typically see a standard HTTPS padlock regardless of EV.
When might EV still be useful?
Some organizations buy EV for compliance narratives, contractual requirements, or internal policy, even though consumer browser differentiation is limited.
What is the difference between DV, OV, and EV?
DV verifies control of the domain. OV verifies organization identity at a standard level. EV follows stricter Extended Validation procedures defined by industry requirements.
Can attackers get certificates for a hijacked domain?
With domain control, attackers can often obtain DV certificates. EV’s stronger org checks raise cost for fraudulent organizational identity, but domain hijacks remain dangerous regardless.
Is EV required for good HTTPS security?
No. Prefer modern TLS versions, strong ciphers, HSTS, correct certificate chains, and protected domain/DNS control. Validation type is secondary to those basics.
References
Explore authoritative guidance and frameworks related to extended validation (ev) certificate.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.