# What Is EV Certificate (Extended Validation certificate)?

> EV certificates are TLS certificates issued after the strictest identity vetting, as defined by the CA/Browser Forum's Extended Validation Guidelines.

Source: https://ssl.sh/glossary/ev-certificate/
Last updated: 2026-11-10

An EV (Extended Validation) certificate is a TLS certificate whose subject identity has been verified under the CA/Browser Forum's EV Guidelines, the most demanding vetting process for publicly trusted TLS certificates. On top of [domain control validation](https://ssl.sh/glossary/dcv/), the CA verifies the organization's legal registration, jurisdiction of incorporation, registration number, physical address and operational existence, and the authority of the people requesting the certificate. The subject carries extra fields such as jurisdictionC, businessCategory and serialNumber, and the certificate asserts the EV policy identifier 2.23.140.1.1.

## Why it matters
EV was designed to give users a strong visual signal: browsers once showed the verified company name in a green address bar. Chrome 77 (2019) removed the company name from the address bar, and Firefox and Safari no longer show it there either, partly because research found that users did not notice when the indicator was missing. Today EV mainly matters for organizations whose policies or regulators require it, and the identity data remains visible in the certificate viewer. EV certificates follow the same maximum validity limits as other TLS certificates.

## Example
```bash
openssl x509 -in example.com.crt -noout -subject
# subject=jurisdictionC = US, jurisdictionST = Delaware, businessCategory = Private Organization,
#   serialNumber = 1234567, C = US, ST = California, L = San Francisco, O = Example Inc., CN = example.com
```

## Common misconceptions
- **EV still turns the address bar green.** Mainstream browsers had removed that UI by 2019.
- **EV offers stronger encryption.** The cryptography is the same as [DV](https://ssl.sh/glossary/dv-certificate/) and [OV](https://ssl.sh/glossary/ov-certificate/); only the paperwork differs.
- **You can buy an EV wildcard.** The EV Guidelines forbid wildcard names; if you need several hostnames, use a multi-domain EV certificate instead.

## Related terms

- [OV 证书](https://ssl.sh/zh/glossary/ov-certificate/): OV 证书是 CA 在验证域名控制权之外，还核实了证书中所写组织真实合法存在的 TLS 证书。
- [DV 证书](https://ssl.sh/zh/glossary/dv-certificate/): DV 证书是 CA 只验证申请者对域名的控制权、不核实申请者身份的 TLS 证书，签发快且可以完全自动化。
- [CA/B 论坛](https://ssl.sh/zh/glossary/ca-browser-forum/): CA/B 论坛是证书颁发机构与浏览器厂商组成的自愿性行业组织，负责制定公开信任证书必须遵守的基线规则。
- [DN](https://ssl.sh/zh/glossary/distinguished-name/): DN 即可分辨名称，是由 C、O、CN 等属性组成的 X.500 风格结构化名称，用来标识 X.509 证书的主体和颁发者。
- [证书策略](https://ssl.sh/zh/glossary/certificate-policy/): 证书策略（CP）是针对某类证书签发和使用制定的一套命名规则，在证书的证书策略扩展中以 OID 形式引用。
- [通配符证书](https://ssl.sh/zh/glossary/wildcard-certificate/): 通配符证书是名称以星号开头（如 *.example.com）、可匹配该域名下任意一级子域名的 TLS 证书。
- [QWAC](https://ssl.sh/zh/glossary/qwac/): QWAC 是欧盟 eIDAS 框架下由合格信任服务提供者签发、把网站与经核实的法人或自然人绑定的证书。