Editing X.509 (section)

===Extended Validation certificates===
Certification authorities operating under the CA/Browser Forum's PKI issue certificates with varying levels of validation. The different validations provide different levels of assurances that a certificate represents what it is supposed to. For example, a web server can be validated at the lowest level of assurances using an email called ''Domain Validation (DV)''. Or a web server can be validated at a higher level of assurances using more detailed methods called ''Extended Validation (EV)''. 

In practice, a DV certificate means a certificate was issued for a domain like <code>example.com</code> after someone responded to an email sent to <code>webmaster@example.com</code>. An EV certificate means a certificate was issued for a domain like <code>example.com</code>, and a company like Example, LLC is the owner of the domain, and the owner was verified by [[Articles_of_incorporation|Articles of Incorporation]].

Extended validation does not add any additional security controls, so the secure channel setup using an EV certificate is not "stronger" than a channel setup using a different level of validation like DV.

Extended validation is signaled in a certificate using X.509 v3 extension. Each CA uses a different [[object_identifier|Object Identifier (OID)]] to assert extended validation. There is no single OID to indicate extended validation, which complicates user agent programming. Each user agent must have a list of OIDs that indicate extended validation.

The CA/Browser Forum's PKI recognizes extended validation and many browsers provide visual feedback to the user to indicate a site provides an EV certificate. Other PKIs, like the Internet's PKI (PKIX), do not place any special emphasis on extended validation. Tools using PKIX policies, like cURL and Wget, simply treat an EV certificate like any other certificate.

Security expert [[Peter_Gutmann_(computer_scientist)|Peter Gutmann]] states CA's created EV certificates to restore profit levels after the [[Race_to_the_bottom|Race to the Bottom]] cut into profits. During the race to the bottom CA's cut prices to lure consumers to purchase their certificates. As a result, profits were reduced and CA's dropped the level of validation they were performing to the point there were nearly no assurances on a certificate.<ref name="gutmann_book" />