One objection that is raised against Extended Validation (EV) SSL is that, for any given Certificate Authority, it tends to cost more than an Organization Validation (OV) or Domain Validation (DV) certificate. One element of this objection is that people would rather pay less than more for things in general, but the other is the idea that somehow it’s unfair for CAs to charge more for EV than OV.

Of course, value to the site is higher since EV causes popular browsers to display the company’s brand name in the address bar, as necessary for compliance with some industry guidelines.

The difference in expense is trivial. It could be a difference of as little as $50 a year. It’s hard to see that as a serious objection on its own, especially considering the potential upside for displaying a company-branded address bar in terms of increased transactions, improved brand perception, and protection from phishing. Rather, there appears to be an emotional component to it.

Ultimately it seems to be a fairness argument. All SSL certificates are just bits. Both OV and EV certificates require authentication. Therefore, it’s not fair to charge more for EV than OV. Or so the thought process goes.

If it were a lock on your door, that would be a different matter. The superior lock might require more metal to manufacture, or more expensive metal or other such components. The presence of these components would help buyers viscerally to understand the additional value – along with the additional expense required to manufacture this high-end lock.

In the case of EV SSL, these additional expenses are invisible to the buyer. Because all SSL certificates occupy the same spot in your infrastructure and entail no physical component, it’s very difficult for an SSL consumer to see that these expenses exist. That’s because these expenses occur behind the scenes.

  • CAs need to employ different information sources, undergo additional CA/Browser Forum procedural steps, and pay for additional third-party audits in order to issue EV certificates.
  • Companies require additional employee training, internal audit, systems, and the like.

These expenses translate to Cost of Goods Sold (COGS). These costs are specific to the set of EV certificates a company sells, so they must be defrayed across the set of EV certificates sold. Otherwise CAs can’t take them on. And because EV SSL is a lower-volume product than other authentication levels, that means the costs are concentrated in a smaller number of individual purchases than they would be for OV or DV.

The good news is that even with these disadvantages, the cost difference remains low, so that EV is still within reach for any company seeking its benefits. And should volume of EV certificates increase over time, CAs may be able to decrease this cost difference even further.