SSL - EV and OV difference in browser address bar

问题:

Many articles say that EV ssl will enable "green address bar" in browser, but I have gone through a good number of websites with top security level, and none of them has a "green address bar". It's just a green padlock with some text.

The only difference is, after the green padlock, some websites show company details like:

And others just say they are 'secure':

Can I say, address bar with company details means EV ssl, and 'Secure' only means OV ssl?

And, big companies like Slack also shows 'Secure' only, does it mean they just use OV ssl?

回答1:

You are right at first, Green Bar with company details means EV SSL Certificate. But only 'Secure' in address bar (Only in Google Chrome) can refer to Domain Validation or Organization Validation.

Domain Validation and Organization Validation Certificate will look alike but there is a difference. Let me explain one by one to clear doubts.

Domain Validation certificate:

Certificate Authorities generally check your control over the domain name before issuing certificate. This validation can be done within few minutes and website can get 'secure' badge (Only in Google Chrome) along with HTTPS prefix.

Organization Validated certificate:

This is one step ahead of Domain Validation certificate, to get such certificate Organization needs to prove business identity to the CA. Users can check business details in Certificate Details >> Certificate Field >> Subject option by clicking on padlock in the web browsers. Google Chrome will show same 'Secure' badge for OV Certificate like DV Certificate.

Extended Validation Certificate:

EV Certificate is one of the best SSL, as companies need to prove their legal identity along with business identity to get company name in address bar. Business name in the address bar can give assurance to the visitors that they are visiting legitimated website.

One can also get different variants upon its usage like, Single Domain SSL (to protect single domain), Wildcard SSL (to protect sub-domains but cannot get EV + Wildcard), SAN (to protect multiple domains), etc. along with above types of SSL Certificates. For more information you should refer to this article.

回答2:

If you see company/organization name after green padlock then you can say that it is secured with EV SSL certificate.

But if you see 'Secure' word after green padlock then you can say that business website/domain is using domain validation, organization validation, domain + organization validation SSL certificate.

Currently, Slack.com is using GeoTrust SSL certificate but no exact SSL type found regarding which SSL product of Geotrust it uses. But I can see organization name in their certificate details and issued the certificate on *.slack.com so they are using GeoTrust Wildcard SSL (Domain + Basic organization validation).