Home/ Buyer guides/ EV SSL
Buyer's guide · EV SSL · 2026 edition
The EV SSL certificate to buy in 2026, if you actually need one.
Most websites stopped needing Extended Validation in 2019, when Chrome dropped the green address bar. If you're still in the audience that does need one (regulated industries, enterprise procurement, payment processors), here is the right one to buy and the right one to skip.
Buy the SSL.com EV UCC SSL at $179/yr, or the same chain repackaged through GoGetSSL at $89/yr.
Both certs sit on the SSL.com root, both pass every browser EV-trust check, and both clear US, EU, and APAC enterprise allow-lists. The price difference is reseller margin, not chain quality. If your build pipeline already requires a DigiCert chain, see pick 02.
The picks, in order
The pick is the verdict above · 02 and 03 are escape hatches
DigiCert Secure Site Pro EV
DigiCert · Lehi, UTPay this if your build pipeline, your CISO, or a procurement allow-list specifically requires the DigiCert chain. The cert is fine; you are paying for the chain name, not the crypto. There is no technical reason to upgrade otherwise.
Roughly 7x the price of the SSL.com pick for the same browser trust.
Sectigo EV SSL (direct)
Sectigo · Roseland, NJA few jurisdictions still hit issuance friction with SSL.com (Russia, parts of MENA). Sectigo direct is the credible fallback: same EV trust tier, broader regional support, $20 more per year, slightly slower validation queue.
Buy direct only. Sectigo's reseller pricing is a maze, and the cheapest reseller (GoGetSSL) is already our pick's reseller route.
The full SKU matrix
Picked rows are highlighted · prices last checked 2026-04-22| Vendor | Product | Validation | Issuance | 1yr | 3yr | Reissue | Browser tier | Petra notes |
|---|---|---|---|---|---|---|---|---|
| SSL.com |
Our pick EV UCC SSL |
EV Org + DUNS | 1-3 days | $179 | $475 | Free | A all major | Cleanest validation queue. eSigner cloud signing in the same console if you ever need it. |
| GoGetSSL |
Our pick (reseller) SSL.com EV (resold) |
EV Org + DUNS | 1-5 days | $89 | $239 | Free | A all major | Same SSL.com chain, half the price. Renewal lives in GoGetSSL's console, not SSL.com's. |
| Sectigo |
Pick 03 Sectigo EV SSL |
EV Org + DUNS | 1-5 days | $199 | $537 | Free | A all major | Use when SSL.com hits regional friction. Validation queue is fine; phone callback window is wider than SSL.com's. |
| DigiCert |
Pick 02 Secure Site Pro EV |
EV Org + DUNS + callback | 1-3 days | $1,295 | $3,495 | Free | A+ legacy enterprise allowlist | Buy only when the buyer has a DigiCert chain requirement. The premium is for the chain name, not the cert. |
| Namecheap | Comodo PositiveSSL EV | EV Org + DUNS | 2-7 days | $79 | $199 | Free | A all major | Cheapest in the table. Comodo chain (now Sectigo). Validation queue is the slowest of the five. |
Buyer-guide signature · the talk-out
You probably don't need an EV cert at all.
The case for EV collapsed in 2019, when Chrome and then Firefox stopped showing the green organisation name in the address bar. The cryptography is identical to OV. Browsers do not warn users any louder. Search engines do not rank EV sites higher. Conversion-rate studies that show EV "lifts" are mostly run by CAs that sell EV.
If you are buying EV in 2026, you are buying it for one of three reasons. You're in a regulated industry where an auditor expects an EV cert in the report (banking, healthcare, US federal, payment processing). Your enterprise procurement allow-list specifically requires an EV-issued chain. You sell to people who still ask "do you have an EV cert" and then check the certificate viewer themselves.
None of those reasons are technical. All of them are organisational. If you can't name which one applies to you, do not buy an EV cert; buy the equivalent OV or DV cert from the same vendor at a third of the price and put the saving toward CAA records, OCSP stapling, or anything else that actually moves your security posture.
Who this guide is for
If neither column fits, you don't need EVBuy if you are
- A regulated business whose external auditor expects an EV-issued chain in the SOC 2 / ISO 27001 / PCI-DSS evidence pack.
- Selling into an enterprise procurement process whose security questionnaire asks "is your TLS certificate Extended Validation?"
- A US federal contractor whose ATO documentation references EV by name in the system security plan.
- Running a payment-card-handling endpoint where EV is part of the acquirer or card-network attestation.
- A bank, brokerage, or insurer whose customer-trust playbook still includes "verify the EV cert in the address bar."
Skip if you are
- A consumer-facing site that thinks the green-bar UI is still a thing. It isn't. Chrome removed it in 2019 and Firefox followed in 2020.
- Trying to "boost SEO" with EV. Google has stated, repeatedly, that certificate validation level does not influence ranking.
- A SaaS startup that feels EV will signal trust to early customers. It will not. Use the budget on a brand designer instead.
- Running an internal-only application behind a corporate VPN. Use a private CA (Smallstep, Vault, your own intermediate) instead.
- Hoping EV will reduce phishing of your domain. It will not. CT-log monitoring + DMARC enforcement does that.
Validation requirements deep-dive
What every CA actually asks forEV is the most paperwork-heavy validation path in commercial PKI. The CA/Browser Forum spec mandates four checks; all five vendors run roughly the same flow, but the queue speed varies.
01 Organisation existence: D&B (DUNS) or government registry +
The CA verifies your legal entity exists by looking it up in either a Dun & Bradstreet (DUNS) record or a national government business registry (Companies House for the UK, Bolagsverket for Sweden, the SEC EDGAR system for US public companies, and so on). DUNS is the most common path because it works internationally.
- Have a DUNS number assigned to your exact legal name (not "doing business as").
- The DUNS record's registered address must match the address on your Articles of Incorporation.
- If you incorporated under the last 12 months, allow 4-6 weeks for D&B to propagate.
If your DUNS record is wrong, fix it before you order the cert. Every CA will reject the order silently, then ask for clarification, then add another 48 hours to the queue.
02 Operational existence: physical address verification +
The CA verifies your business has a physical presence at the address on file. They do this through one of four methods: a third-party verifier visit (rare, expensive), a bank-issued letter of confirmation (annoying, takes a week), a utility bill match (most common), or a Qualified Independent Information Source like D&B (fastest if you've already got DUNS sorted).
- If your address is a registered agent / virtual office, expect to provide a separate "actual operations" letter.
- P.O. boxes do not satisfy this requirement.
- WeWork-style shared addresses pass at SSL.com and Sectigo, fail at DigiCert about a third of the time.
03 Authority verification: callback to a published number +
The CA calls a phone number that is published in your DUNS record or government filing, and asks the person who answers to confirm that the named requester is authorised to buy a certificate on behalf of the organisation. This is the step that breaks the most often.
- The phone number on your DUNS record must be live and answered in business hours.
- The person who answers must know your name and the fact that you are buying a cert.
- If the CA can't get through, they will retry once within 24 hours, then put the order back in the queue and email you a missed-call notice.
I keep a one-line internal procedure for this: when I order an EV cert, I email the company receptionist the same morning with the buyer's name and the issuing CA. Saves a 48-hour reset.
04 Domain control: standard CA/B Forum methods +
EV adds nothing here that OV doesn't already require. You prove control of the domain via DNS TXT record, file at /.well-known/pki-validation/, or email to one of five approved addresses (admin, administrator, hostmaster, postmaster, webmaster). Use DNS TXT — it's the only method that works cleanly through an automation pipeline.
05 Approver authorisation: signed letter on letterhead +
An officer of the company (CEO, CFO, COO, or someone whose authority is documented in the corporate filings) signs a letter on company letterhead authorising the named requester to obtain an EV certificate. SSL.com and Sectigo accept a PDF; DigiCert occasionally still asks for a wet-ink original mailed in.
If your signing officer is travelling, get this letter pre-signed on the day you initiate procurement. Don't wait for the CA to ask.
Questions readers send me about EV SSL
Does EV still show a green bar in any browser?
No. Chrome removed the green organisation name from the address bar in version 77 (September 2019). Firefox followed in version 70 (October 2019). Safari has not shown EV branding in the address bar since 2018. The organisation name is still in the certificate, viewable through the browser's cert viewer, but no major browser surfaces it in normal UI.
Does Google rank EV sites higher in search?
No. Google has stated, multiple times, that certificate validation level (DV vs OV vs EV) is not a ranking signal. HTTPS itself is a ranking signal, but the validation tier behind the cert is not.
How long does EV validation actually take?
Median 1-3 business days at SSL.com and DigiCert, 1-5 at Sectigo, 2-7 at Namecheap (Comodo). The variable is almost always the authority-callback step. If your DUNS phone number is live and the person who answers knows you're ordering a cert, you'll be at the fast end of those ranges. If it isn't, you'll be at the slow end, and you'll discover this 48 hours after you ordered.
Can I buy a 3-year EV cert?
You can buy a 3-year subscription, but the cert itself is reissued every 397 days (the CA/Browser Forum maximum). The 3-year price is just a discount on three sequential issuances. As of 2026, the CA/B Forum is moving toward 90-day TLS certificate validity for all DV certs; OV and EV are likely to follow within 2-3 years. Don't pay for a 3-year subscription expecting to skip renewals.
Is the DUNS number a one-time setup or ongoing cost?
DUNS itself is free; you can request one from D&B at no cost. D&B will try to upsell you a "Credibility Plus" subscription at around $229/yr that promises faster updates to your record. You don't need it for EV cert issuance. Politely decline.
Can I migrate from DigiCert EV to SSL.com EV?
Yes. There is no "migration" in the technical sense; you order a new EV cert from SSL.com, validate it (which is faster the second time because your DUNS and approver letter are already on file), and swap it on your servers at next deploy. Your DigiCert cert keeps working until its expiry date. The total switching cost is one CSR generation and one server restart.
What's the difference between EV UCC and standard EV?
EV UCC (Unified Communications Certificate) supports multiple Subject Alternative Names on a single EV certificate. Useful for Microsoft Exchange, Lync, and any deployment where you need EV trust on several hostnames. Standard EV is single-hostname only. SSL.com's UCC pricing is what's quoted in the comparison table; their single-hostname EV is $20/yr cheaper.
Is GoGetSSL safe to buy from?
Yes. GoGetSSL is a long-standing reseller (founded 2009, EU-registered) that resells Sectigo and SSL.com chains at margin discounts. The cert you receive is identical to the one you'd buy direct; the support relationship is with GoGetSSL rather than the issuing CA. For most buyers that's fine; if your enterprise procurement requires a direct contract with the issuing CA, you'll pay the direct price.