EV SSL validation

EV validation is the most extensive validation for an SSL certificate. EV stands for Extended Validation, and is the International Standard to show who owns a Website. The certificate is identified by providing a green address field in the browser as well as information about the business that owns the domain.
Commfides who has the role of independent trusted third party validates the business and confirm that it exists, is legitimate, located at the specified business address and that there is a correspondence between the Brønnøysund Register Centre, the Official Domain Register (WHOIS) and the information contained in the certificate.

The validation and implementation requirement for the Extended Validation Standard is determined by the  CA Browser Forum that applies to all CA (Certification Authorities). The CA/B Forum consists of leading CAs and browser manufacturers, as well as representatives from legal and security agencies.

The EV standard improves the security of transactions over the Internet and creates a more intuitive method for displaying secure web pages for online users.
The uniqueness about an EV certificate is that it is not the CA itself that determines the validation routines, as it is for other types of certificates. EV is an independent standard for all countries, and makes it easy for users to recognize the green address bar that provides security.

Validation

EV validation has an organizational validation at the bottom but in addition to organizational data in the public records, the company’s IT manager (or other person holding a leading title) also needs to sign two EV-certificate agreements.
Finally, a call-back call is made to the business, where the CA must call directly to the company’s switchboard. Therefore it is very important that the registrars like gulesider.no and Dun & Bradstreet are updated with the correct phone number.

TIPS FOR EFFECTIVE EV VALIDATION

• Check the entry of the domain in WHOIS/Norid for Norwegian domains. Who owns the domain?
• Check the listing of domain owners in the Brønnøysund Register Centre. Does the information match the WHOIS?
• Be precise with the information in the CSR file. Enter the organizational name as listed in the Brønnøysund Register Centre, in the O: field.
• Check the listing of the official phone number of the business in Dun and Bradstreet. Is it the switchboard that can transfer the call from the validation personnel?
• Check if the business has control over the five generic email addresses to which DCV validation mail is sent to:
  • admin@xxxxx.no
  • administrator@xxxxx.no
  • webmaster@xxxxx.no
  • postmaster@xxxxx.no
  • hostmaster@xxxxx.no

Additionally: Check which email address is listed in WHOIS – this can also receive DCV emails.