---
title: "SSL certificates and EV"
subject: "Information System"
chapter: 2
key: "semester_8/information_system:ssl-extended-validation"
source: https://www.bctengineer.com/q/semester_8/information_system/ssl-extended-validation
site: BCT Engineering
---

# SSL certificates and EV

Information System · Chapter 2: Control, Audit and Security of Information Systems

- Asked in: 2070 Bhadra, 6+4 marks
- Video: [Difference Between SSL and EV SSL](https://www.youtube.com/watch?v=R1kmMSwWndg) — Anuraag Singh
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/information_system/ssl-extended-validation
- Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2

## Question

Explain SSL Certificates for client server connections over the web. What do you mean by Extended Validation?

## Short answer

SSL/TLS certificates bind a server's identity to a public key via a trusted Certificate Authority, enabling authentication, encrypted communication, and data integrity. The handshake establishes a session key after certificate verification. Extended Validation (EV) certificates involve rigorous identity checks of the organization's legal, physical, and operational existence, offering higher trust against phishing, originally shown by a green address bar.

## Answer

#### SSL certificates
**SSL/TLS (Secure Sockets Layer / Transport Layer Security)** is a protocol that creates an encrypted channel between a client (browser) and a web server. An **SSL certificate** is a digital document, issued by a trusted **Certificate Authority (CA)**, that binds a public key to the identity (domain name, organization) of the server. It follows the X.509 standard and contains the domain name, owner, public key, issuer (CA), validity period and the CA's digital signature.

Purposes:
- **Authentication** - the client confirms it talks to the real server.
- **Encryption** - data cannot be read in transit.
- **Integrity** - data cannot be altered unnoticed.

#### How it works (handshake)
```text
 Client                         Server
   |--- ClientHello ----------->|
   |<-- ServerHello + Cert -----|
   | verify cert with CA        |
   |-- encrypted session key -->|
   |<==== encrypted data =====> |
```
1. Client requests a secure connection and lists supported ciphers.
2. Server sends its certificate with its public key.
3. Client checks that the CA is trusted, the certificate is valid and not expired, and the domain matches.
4. Client creates a session key, encrypts it with the server public key and sends it.
5. Server decrypts it with its private key; both use the symmetric session key for fast encrypted communication. The browser shows HTTPS and a padlock.

Types by validation level: Domain Validated (DV), Organization Validated (OV), and Extended Validation (EV). By coverage: single domain, wildcard, multi-domain.

#### Extended Validation (EV)
An **EV certificate** is issued after the CA carries out the strictest checks defined by the CA/Browser Forum: legal, physical and operational existence of the organization, identity and authority of the requester, and ownership of the domain.
- Browsers once displayed a green address bar or company name, giving users higher trust (modern browsers show less distinction).
- Used by banks, payment gateways and large e-commerce sites to reduce phishing and increase customer confidence.
- Costs more and takes longer to issue than DV/OV certificates.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What does an SSL certificate do?
   A. Stores user passwords
   B. Encrypts the hard disk
   C. Blocks malware
   D. Binds a public key to the identity of the server, issued by a CA
   Answer: D. It follows X.509 and carries the CA's digital signature. (Key point: Certificate role)

2. In the handshake, how is the session key sent?
   A. Client encrypts it with the server public key; server decrypts with its private key
   B. Server sends it in plain text
   C. Client encrypts it with its private key
   D. It is sent by the CA
   Answer: A. Then symmetric encryption is used for fast communication. (Key point: Session key)

3. What does the client check in the certificate?
   A. Server's disk size
   B. Trusted CA, not expired and domain matches
   C. User's password
   D. Number of visitors
   Answer: B. These checks authenticate the server. (Key point: Client checks)

4. What defines an Extended Validation certificate?
   A. Only domain control is checked
   B. No checks are done
   C. Strictest checks on the organization's existence, requester authority and domain ownership
   D. It is free and instant
   Answer: C. DV checks domain only, OV some organization details, EV the strictest. (Key point: EV)

## Related in Information System

- [Web mining with structure mining](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Aweb-mining-structure-mining) — Information System, chapter 7

## Related in other subjects

- [Client-side versus server-side scripting](https://www.bctengineer.com/question.md?key=semester_7%2Fweb_technology%3Aclient-vs-server-side-scripting) — Web Technology, chapter 3, asked 3×
- [Internet vs WWW; client-server paradigm](https://www.bctengineer.com/question.md?key=semester_7%2Fweb_technology%3Ainternet-vs-www-client-server) — Web Technology, chapter 1
- [Server before client; TCP reliability](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Atcp-server-before-client-reliability) — Computer Networks and Security, chapter 5, asked 2×
- [Short note: Client-Server and Master-Slave](https://www.bctengineer.com/question.md?key=semester_8%2Fbig_data_technologies%3Ashort-note-client-server-master-slave) — Big Data Technologies, chapter 1