Skip to main content

SSL certificates and EV

Short answer

SSL/TLS certificates bind a server's identity to a public key via a trusted Certificate Authority, enabling authentication, encrypted communication, and data integrity. The handshake establishes a session key after certificate verification. Extended Validation (EV) certificates involve rigorous identity checks of the organization's legal, physical, and operational existence, offering higher trust against phishing, originally shown by a green address bar.

Explain SSL Certificates for client server connections over the web. What do you mean by Extended Validation?

SSL certificates

SSL/TLS (Secure Sockets Layer / Transport Layer Security) is a protocol that creates an encrypted channel between a client (browser) and a web server. An SSL certificate is a digital document, issued by a trusted Certificate Authority (CA), that binds a public key to the identity (domain name, organization) of the server. It follows the X.509 standard and contains the domain name, owner, public key, issuer (CA), validity period and the CA's digital signature.

Purposes:

  • Authentication - the client confirms it talks to the real server.
  • Encryption - data cannot be read in transit.
  • Integrity - data cannot be altered unnoticed.

How it works (handshake)

 Client                         Server
   |--- ClientHello ----------->|
   |<-- ServerHello + Cert -----|
   | verify cert with CA        |
   |-- encrypted session key -->|
   |<==== encrypted data =====> |
  1. Client requests a secure connection and lists supported ciphers.
  2. Server sends its certificate with its public key.
  3. Client checks that the CA is trusted, the certificate is valid and not expired, and the domain matches.
  4. Client creates a session key, encrypts it with the server public key and sends it.
  5. Server decrypts it with its private key; both use the symmetric session key for fast encrypted communication. The browser shows HTTPS and a padlock.

Types by validation level: Domain Validated (DV), Organization Validated (OV), and Extended Validation (EV). By coverage: single domain, wildcard, multi-domain.

Extended Validation (EV)

An EV certificate is issued after the CA carries out the strictest checks defined by the CA/Browser Forum: legal, physical and operational existence of the organization, identity and authority of the requester, and ownership of the domain.

  • Browsers once displayed a green address bar or company name, giving users higher trust (modern browsers show less distinction).
  • Used by banks, payment gateways and large e-commerce sites to reduce phishing and increase customer confidence.
  • Costs more and takes longer to issue than DV/OV certificates.

✓ Answer checked by Claude Opus 5.5 (high effort)

Related questions

All Information System chapter 2 questions →