EV Certificate (Extended Validation certificate)

An EV (Extended Validation) certificate is a TLS certificate whose subject identity has been verified under the CA/Browser Forum's EV Guidelines, the most demanding vetting process for publicly trusted TLS certificates. On top of domain control validation, the CA verifies the organization's legal registration, jurisdiction of incorporation, registration number, physical address and operational existence, and the authority of the people requesting the certificate. The subject carries extra fields such as jurisdictionC, businessCategory and serialNumber, and the certificate asserts the EV policy identifier 2.23.140.1.1.

Why it matters

EV was designed to give users a strong visual signal: browsers once showed the verified company name in a green address bar. Chrome 77 (2019) removed the company name from the address bar, and Firefox and Safari no longer show it there either, partly because research found that users did not notice when the indicator was missing. Today EV mainly matters for organizations whose policies or regulators require it, and the identity data remains visible in the certificate viewer. EV certificates follow the same maximum validity limits as other TLS certificates.

Example

openssl x509 -in example.com.crt -noout -subject
# subject=jurisdictionC = US, jurisdictionST = Delaware, businessCategory = Private Organization,
#   serialNumber = 1234567, C = US, ST = California, L = San Francisco, O = Example Inc., CN = example.com

Common misconceptions

• EV still turns the address bar green. Mainstream browsers had removed that UI by 2019.
• EV offers stronger encryption. The cryptography is the same as DV and OV; only the paperwork differs.
• You can buy an EV wildcard. The EV Guidelines forbid wildcard names; if you need several hostnames, use a multi-domain EV certificate instead.