Professional Opinion Letter – EV SSL

The Relationship between an Extended Validation Secure Sockets Layer (EV-SSL) Certificate and the Professional Opinion Letter

In the modern world of electronic commerce, the customer wants to know that their consumer and business transactions are protected. Traditionally, this has meant relying solely on the protection of hiding the data being transferred back-and-forth between the buyer (customer) and the seller over the Internet. The means to enable that was the encryption enabled by Secure Sockets Layer (SSL) provisioned by the end-user/customer's browser and the web server of the seller. While that might be sufficient in most cases to prevent intended or unintended capture of sensitive data being transacted over the public Internet by 3 rd parties, it does little to nothing to prevent an improper transaction between the primary parties - buyer and seller based on lack of trust basics.

SSL is comprised of a set of cryptographic protocols which are designed to provide packet-level security over the Internet. They use certificates (which are based on their own protocol) and asymmetric cryptography to assure verification and protected communications with the opposite party, by the exchange of key between the endpoints (e.g., web browser and web server). This session key is then used to encrypt data flowing between the parties. This allows for data/message confidentiality and message authentication codes for message integrity, and as a by-product, message authentication. SSL Certificates were only issued to a real business or individual in the early usage timeframes. Before issuing you an SSL Certificate, the CA would verify your domain ownership, business registration and address, phone number, and other pertinent information. But there was no standard in place to make them verify all those details, and over time, there has been lax enforcement of those requirements of business validity.

Extended Validation SSL (EV-SSL) Certificates are a means to reintroduce those validations on the business entity. The provider of an EV-SSL certificate requires additional evaluation of the business, by the use of a 3 rd -pary confirmation of business presence. The 3 rd -party evaluator is either a licensed attorney in the United States or a licensed accountant. It is the task of these 3 rd parties to perform due diligence to review evidence of the business presence of the entity seeking to apply the certificate to their web site. The end-user's browser recognizes these businesses that have undergone the procedures for an EV-SSL certificate by presenting a green address bar. The professional opinion letter by a licensed independent 3 rd -party is the additional level of assurance that the buying end-user expects in their ecommerce transactions.

The end result is better confidence on the part of the end-user in the business entity, and hence, greater revenues for the businesses employing this technology. EV-SSLLetter.com ( www.ev-ssl-letter.com ) is a professional service that takes seriously the need for rigorous analysis of the client's evidence, and providing a prompt an d helpful response to the client in achieving their objectives in their application process. We are more than happy to answer any additional questions the client might have in respect to EV-SSL certificates and the opinion letter process.