Talk:Extended Validation Certificate

message: Article should be Extended Validation Certificate, High Assurance should be a redirect, the article should not mention SSL as they are not only used for SSL. --Gorgonzilla 15:56, 7 November 2006 (UTC)
replies: text: Incorrect;  the EV Guidelines are specifically for SSL certificates.  The CA/B Forum may address vetting regimes for other types of digital certificate in future.  "High assurance" should not be used for EV as this term is used by some CAs (notably Comodo) for their standard organisational vetted certificates. -- Cryptoki 01:49, 27 January 2007 (UTC)
replies: text:  Nope.  The guidelines do note that the current version only covers SSL uses, but future versions may cover other specifically listed protocols in the future.  The title of the document is as stated, and I've moved the article.  --NealMcB 00:03, 22 February 2007 (UTC)
thread_title:  Name is wrong 

message: :  The CA/Browser Forum has posted a new Version 1 of the EV Guidelines, which addresses many of the issues crticised in earlier drafts.  Notably, the Guidelines now allow EV certificates to be issued to non-corporate entities such as individuals and partnerships.  http://www.cabforum.org/ --Cryptoki 18:00, 12 June 2007 (UTC)
thread_title:  Version 1 of the EV Guidelines 

message: Verisign has issued at least one non-compliant Extended Validation certificate.
The certificate, which was issued for Mellon Investor Services, and can be
seen on that site, has SUBJECT information as follows:
:CN = www.melloninvestor.com
:OU = Terms of use at www.verisign.com/rpa (c)05
:OU = IT
:O = Mellon Investor Services
:L = Jersey City
:ST = New Jersey
:C = US
The "Jurisdiction of Incorporation" and "Registration Number" required by
the standards at  are NOT present.
That seems to be a violation of the standards.
The ISSUER is
:CN = VeriSign Class 3 Secure Server CA
:OU = Terms of use at https://www.verisign.com/rpa (c)05
:OU = VeriSign Trust Network
:O = VeriSign, Inc.
:C = US
Interesting.  Already Verisign seems to be breaking the rules.  --John Nagle 18:22, 3 January 2007 (UTC)
replies: text: I've been in touch with Verisign.  That is not a "High Assurance with Extended Validation" certificate, according to Spiros Theodossiou of Verisign. --John Nagle 19:12, 3 January 2007 (UTC)
thread_title:  Verisign issuing invalid certificates? 

message: I've added a table of the OID values which identify Extended Validation certificates.
There's no unified way to identify EV certificates; each vendor has a different OID, silly though that is.  There's no published table of this information yet, but each vendor's certification practice statement has their OID.  So I've looked up the values for three major vendors and cited them appropriately.  Please add to the table.  Carefully, please. Find the Certification Practice Statement and cite the page from which the OID came. There's no public list of this information elsewhere, so people will use these numbers.  --John Nagle 07:47, 14 January 2007 (UTC)
replies: text: I've added Thawte's OID per their CPS. Unfortunately their page numbering is inconsistent, and restarts at 1 after page 93 - so page 95 is actually marked "2". Morgan Collett 13:13, 16 January 2007 (UTC)

text: The information from Quo Vadis doesn't seem to appear in their Certification Practice Statement, so I put a "citation needed" tag on that entry. --John Nagle 18:29, 17 January 2007 (UTC)
thread_title:  OID table now covers 4 main vendors.  Please make appropriate additions. 

message: * The title of this section should remain "Exclusion of Small Businesses".  Changing it to "Encompassing Small Business" is misleading: the criticism of EV described in this section, widely discussed both online and in articles written about EV, is that small businesses are excluded. Ka-Ping Yee 00:20, 6 February 2007 (UTC)
thread_title:  Exclusion of Small Businesses 

message: * Again, the concern here is specifically that EV will not stop phishing.  The study specifically studied vulnerability to phishing attacks, so the title of the section should mention them. Ka-Ping Yee 00:27, 6 February 2007 (UTC)
thread_title:  Vulnerability to Phishing 

message: The certificate you get from the URL https://www.verisign.com contains another CPS pointer than the one, which is displayed in the table in this article (see last entry, for VeriSign). Here is, what you find in the certificate: https://www.verisign.com/rpa. The content of that page seems not to be a CSP.
But you may find another one at VeriSign's web pages: https://www.verisign.com/repository/CPS/VeriSignCPSv3.5.pdf. However, I tend to believe that sites CPS pointers point to should be secured by SSL/TLS as well.
Zettmann 16:44, 20 September 2007 (UTC)
thread_title:  Wrong Certification Practice Statement pointer for VeriSign? 

message: The cite for GlobalSign's OID is vague; it's a link to a page of various GlobalSign links. Unlike all the others, there's no page number.  I can't find the OID in those documents.
It's worth keeping this detailed list accurate; as far as I know, there's still no other public collection of where all the OIDs for EV certs are defined.  --John Nagle (talk) 05:18, 14 February 2008 (UTC)
thread_title:  Cite for GlobalSign needs improvement 

message: Someone linked to 'SSL 247' which is a certificate reseller.  They divide certificates into three categories.
* Domain validation (DV) - "Gives no 3rd party assurances as to who owns the website." This is what some issuers call "Quick SSL" - it doesn't validate much of anything.
* Organization validation (OV) - "Give end users 3rd party proof that the company who owns the website is legitimate. Identifies the company in question also." This requires some verification of business identity. Somewhat more expensive than DV.
* Extended validation (EV) - Like OV, but "activates the ‘green bar" in browsers. Much more expensive than OV or DV.
Most users, and browsers, don't distinguish between DV and OV.  Globalsign has a similar classification . StartSSL seems to use the terms "Class 1" and "Class 2" for "DV" and "OV". We make that distinction internally within our SiteTruth system; lacking any standard to follow, we consider a cert with an "L" (location) field to be an OV cert.  
Is this accepted nomenclature, or is this just Globalsign and their resellers? Is there a standard way to distinguish a DV cert from an OV cert?    --John Nagle (talk) 17:40, 11 March 2008 (UTC)
replies: text: This doesn't seem to be standard terminology, so it doesn't go in the article.  Although it's not info suitable for Wikipedia, I've been exchanging E-mail with the CA Browser Forum, and they only do EV certs; they have no intention of dealing with any other cert related issues. --John Nagle (talk) 04:38, 13 March 2008 (UTC)
thread_title:  DV, OV, and EV certs - who makes that distinction? 

message: This technology isn't as great as it may seem.  The biggest problem with it is that it only adds another authority figure with the keys and ability to issue the coveted EV approval.  It has no significant technological advantage over crypt standards already being used, and it promotes the chain of trust instead of the web of trust.  I think its a scam to be honest.  In fact, I'm going to apply for my own OID and call it cAShakeMoneyHands, a superior mark only available to the richest webmasters, and it will be way more valuable than the EV bit.  The only think I need to do is buy in on the browser idiocy scam, maybe offer some stock under the table. — Preceding unsigned comment added by 96.13.29.139 (talk)  96.13.29.139
:It's not a "technology" at all, except for the part of the browser that says "make this thingy green now". The certificates are technically identical to "reduced validation" certificates, they just have a bit that says "I'm EV! Trust me!". A business performs the validations. That's business, not technology. --76.247.105.43 (talk) 21:41, 25 March 2009 (UTC)
thread_title: This technology isn't as great as it may seem.

message: I have added a new image taken on IE 8 and Firefox 3.5 and edited the description that was "no longer turns yellow to indicate a secure connection" to "turns Green color to indicate a secure connection". Lakshmi VB Narsimhan 09:34, 21 July 2009 (UTC)
thread_title: Added image and Description

message: I have also added an image an EV Certificate (PayPal's), yet numerous times they have been removed.
I have taken the screenshot myself, and I doubt that PayPal care about this image. If someone or a bot removes this I will be editing the name out. 
Thompson.matthew (talk) 03:07, 25 December 2009 (UTC)
thread_title:  Another Image Added 

message: The section on the study that Tec-Ed conducted on user responses to the EV "green bar" was missing some very significant information about how the study was conducted -- information that reduce the study's reliability to a level that is probably below what would be considered acceptable in an academic context. 
Methodological flaws include:
*The two web site mock-ups with and with EV and without EV had radically different graphic designs, color palettes, and content. The effect of design on conversion rates and visitor confidence is well established.
*Subjects were selected to have a high degree of familiarity with and concern about internet security, so the results are not applicable to the general internet-shopping public.
*The researchers called the subjects' attention to the 'security features' at the top of the browser, then explained to them what the green bar meant and how it indicated increased security  before asking them questions about it.
The study in question is titled "Extended Validation and VeriSign Brand" and includes questions that deal exclusively with brand recognition of VeriSign, a major provider of EV SSL services, and is available on the VeriSign web site. Though it is not mentioned in the white paper, it seems obvious that the research was funded by VeriSign. This doesn't invalidate its results by itself, but in combination with the methodological problems mentioned above, the funding source could lead to some suspicions about the objectivity of the research.  —Preceding unsigned comment added by 207.194.3.2 (talk) 22:24, 26 February 2010 (UTC)
thread_title:  Added more information about Tec-ED research 

message: Restored the certificate identification data section. There was some controversy over listing prices, so I left those out, but the table of OIDs which identify an EV certificate is useful.
The only way to identify an EV certificate is to have a table of the OID values used by each CA. That table is hard to obtain.  Wikipedia is one of the very few public places where that data is available. --John Nagle (talk) 05:47, 16 February 2011 (UTC)
thread_title:  Restored certificate identification data 

message: This page seems to have ongoing relevance and I agree with John that the OIDs are helpful.  Not sure if the consensus is that the neutrality issue has been resolved, but the whole  article does seem to need a refresh.  The business has changed with Symantec now owning VeriSign, Thawte, GeoTrust and RapidSSL.  Our organization uses thawte, and checking the reference for the CPS, I found it quite out of date (link is dead, and their current version of the CPS is 3.7.3 (6 versions since 3.3, though some minor).  I updated the CA/Browser link, but would have to spend a bit of time updating the whole page.  Do people think a refresh would be useful, or are we in the final stages before the predicted "inevitable collapes" and should let this page slowly collapse with it?  (I'm not en experienced editor, but I'm willing to take a crack if I can find some spare time.)  Wigbold (talk) 13:32, 16 June 2011 (UTC)
thread_title:  Full refresh needed? 

message: The CA/Browser forum seems to be making some major changes, but they're hard to figure out. 
First, they now recognize three levels of certificate: "domain-validated", "organizationally validated", and "extended validation". There was some discussion on this talk page previously about some CAs making similar distinctions, but there was no standard. Now, there is, sort of.  That's probably worth a mention in the article. 
Second, the CA/Browser forum seems to be trying to establish itself as the standards authority for all CA-issued certificates used for web browsing (as opposed to code signing, email, etc.)  They have a draft  of a standard for issuance of all browser-trusted certs.  Previously, the IETF standardized that. More on this later. --John Nagle (talk) 19:41, 7 August 2011 (UTC)
thread_title:  Changes at CA/Browser forum 

message: The list of valid EV OIDs used by Mozilla/Firefox is actually compiled into the code for Firefox. It can be found here..  Using that data in Wikipedia, though, might be OR, although we can link to it. --John Nagle (talk) 17:04, 30 March 2012 (UTC)
thread_title:  Mozilla list of EV cert OIDs 

message: In the OID list there is 1 star sign at "DigiNotar*" and 2 star signs at "TrustWave**", but nowhere is a footnote what "*" and "**" means. Also, the "Web browsers" section is shown inside the OID-table (left column) which looks very weird once expanded (using latest IE). Someone else has this issue? --217.229.1.88 (talk) 22:39, 27 June 2012 (UTC)
thread_title:  Stars 

message: The following revert http://en.wikipedia.org/w/index.php?title=Extended_Validation_Certificate&diff=499678826&oldid=499670486 with the note "No indication of notability" seems to be ignorant. CERTUM is one of Poland's largest CAs and it is trusted in all major browsers as well as Windows. Therefore it is used as popular AuthentiCode CA and used for many OpenSource projects since they give free certificates to OpenSource developers (e.g. the developers of TurtoiseSVN). I do not see any reason why this article should not contain this OID since it is a valid EV OID by an international trusted CA. So please re-add this edit. --79.255.123.170 (talk) 03:44, 27 July 2012 (UTC)
thread_title:  Certum revert 

message: There have been some changes since 2012. The CA/Browser Forum issued "Baseline Requirements" for all certs, effective July 2012. The new rules now recognize "DV" (Domain Validated), "OV" (Organization Validated), "IV" (Individual person Validated) and "EV" (Extended Validation) certificates. Associated with this are new OIDs for OV certificates, one per CA, which work the same way EV OIDs work. As for EV OIDs, the CA-specific OIDs are in each CA's Certification Practice Statement.
So what do we do to the article?  Add a column or two to the big table in this article?  Or should this go in CA/Browser Forum, or somewhere else.  One consolidated table is more useful than several, spread over multiple articles. Comments?  John Nagle (talk) 18:21, 27 October 2014 (UTC)
thread_title:  DV, OV, and EV certs 

message: Hello fellow Wikipedians,
I have just added archive links to  on Extended Validation Certificate. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive https://web.archive.org/20080415165830/http://online.wsj.com:80/public/article/SB116649577602354120-5U4Afb0JPeyiOy1H_j3fVTUmfG8_20071218.html?mod=rss_free to http://online.wsj.com/public/article/SB116649577602354120-5U4Afb0JPeyiOy1H_j3fVTUmfG8_20071218.html?mod=rss_free
*Added archive https://web.archive.org/20120229051108/http://cabforum.org/Guidelines_v1_2.pdf to https://www.cabforum.org/Guidelines_v1_2.pdf
When you have finished reviewing my changes, please set the checked parameter below to true to let others know.
Cheers.—cyberbot IITalk to my owner:Online 18:38, 31 December 2015 (UTC)
thread_title:  External links modified 

message: think about it.
had normal certs still the validation needs and price of an EV then 
a) Individuals couldn't get an SSL cert
b) smaller businesses might have a problem with the prices
in short SSL wouldn't be where it is today. Without pure domain Validation, things like StartSSL or Let's Encrypt wouldn't even exist which gives indivuiduals and web communities a very nice way to use HTTPS so their Users' Passwords wont be seen, while keeping a high validation standard that is visible to the users for Banks and similar stuff. and with banks trying to teach their web users to watch for the green bar, phishing via impersonation gets harder.
also since EV certs (unlike normal certs) enforce revocation checks (unlike normal certs because the outage would be too high if they would be enforced and the OCSP/CRL is offline for whatever reason).
Prople might say that EVs are "just a way to get their high prices and lost standards back", but in the end, the lowering of the cert prices and even creating free CAs made ssl popular enough that browsers can be starting to think about to mark plain HTTP sites as insecure.
My1 09:08, 10 February 2016 (UTC)
thread_title:  EV certs fault of CAs' lower validation for normal certs? In the end it was a good thing. 

message: Hello fellow Wikipedians,
I have just modified  on Extended Validation Certificate. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive http://web.archive.org/web/20110923180445/http://vasco.com:80/company/press_room/news_archive/2011/news_vasco_announces_bankruptcy_filing_by_diginotar_bv.aspx to https://www.vasco.com/company/press_room/news_archive/2011/news_vasco_announces_bankruptcy_filing_by_diginotar_bv.aspx
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—cyberbot IITalk to my owner:Online 04:29, 23 June 2016 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified one external link on Extended Validation Certificate. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added  tag to http://www.affirmtrust.com/images/AffirmTrust_CPS_v1.1_12-23-2010.pdf
*Added archive https://web.archive.org/web/20050526234515/http://wellsfargo.com/cps/ to http://www.wellsfargo.com/cps
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 11:37, 26 September 2017 (UTC)
thread_title:  External links modified 

message: Hello fellow Wikipedians,
I have just modified one external link on Extended Validation Certificate. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20151231171309/https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=SO10090&actp=search&viewlocale=en_US&searchid=1406590748892 to https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=SO10090&actp=search&viewlocale=en_US&searchid=1406590748892
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 11:15, 20 January 2018 (UTC)
thread_title:  External links modified (January 2018)