Chrome 77 hides the Extended Validation company name behind the padlock. EV certificates still encrypt and still verify the business, but visitors rarely look. At renewal, ask whether anything requires EV; most small business sites do not need it.

What changed today

Chrome 77, released today, no longer shows a company's name beside the address on sites using an Extended Validation certificate.

Until now, those sites showed the registered business name next to the padlock, ahead of the address. From today they look like any other secure site: a padlock and the address.

The name has not gone entirely. It now appears in the panel that opens when somebody clicks the padlock, which few visitors ever do.

If your business paid extra for that name, this is the week to decide whether to keep paying.

Three kinds of certificate

The fourth is the part most often misunderstood. The padlock and the encryption are identical for all three; what differs is how much the issuer checked about who asked.

Why Chrome moved it

Google's stated reason is that people do not notice the name, or its absence, so it was not protecting them as intended. Safari stopped showing it last year.

There is also a weakness in any company name shown that way. Names are not unique: two businesses in different provinces or countries can register the same one quite legitimately.

The address is the more reliable signal, and it is what visitors are usually told to check.

What visitors actually look at

Most people judge a site by its page rather than its certificate. They look for the name they expected, a phone number, an address, recent dates, and whether it resembles the business they called.

In the address bar they notice two things at most: a warning, such as the Not secure label Chrome has shown on plain HTTP pages since July last year, and sometimes the address.

The padlock itself says less than people assume. It means the connection is private, not that the business behind it is genuine; impostor sites get certificates too, free and automatically.

On phones, the address bar shows the domain at most, and often shrinks away once the page scrolls.

So the trust a business builds online sits on its pages and in its domain name, not in the details of its certificate.

What an EV certificate still does

An EV certificate still encrypts the connection, exactly as before. Nothing about the site's security changes today.

It still records the verified legal name of the business, its jurisdiction and registration details, readable by anyone who opens the certificate.

Some organisations need that record. A supplier contract may require it, or a large customer's security questionnaire may ask for it.

What it no longer does in Chrome is show the name without anyone looking, which was much of what small businesses paid for.

A worked example

A property management company looking after rental buildings bought an EV certificate four years ago, after a sales call suggested tenants paying rent online would trust a company name in the address bar.

Each renewal meant incorporation documents, verification calls and a manual installation. When this month's renewal notice arrived, the owners asked what the extra cost was buying, and noticed that rent was never paid on their site at all.

Tenants paid through a portal run by the company's property software provider, on its own domain, with its own certificate. The company's site held listings, a maintenance request form and a link to that portal.

That site needs encryption, which any certificate provides, and a renewal nobody can forget. They are moving to a domain validated certificate that the host renews automatically, before the old one expires.

The verified details are going where tenants look: the full legal name, licence details and office address on every page, and the portal's address printed on every lease.

What to consider at renewal

Start with whether anything requires EV: contracts, payment processor agreements, a large customer's security questionnaire. If nothing does, it is a choice, not an obligation.

Then compare effort as well as price. EV means paperwork and a manual renewal every time; a domain validated certificate can renew itself, and many hosts now include one.

Check what the certificate covers: the address with and without www, plus any subdomains in use. An EV certificate cannot cover all subdomains at once the way a wildcard certificate can.

And plan the switch so there is no gap, with the new certificate installed and working before the old one expires.

Renewals that nobody watches

The bigger risk with any certificate is not its type but its expiry date. An expired certificate stops every visitor at a full-page warning, which does far more harm than a missing name.

Certificates last at most 825 days, free ones ninety, and automatic renewal handles most of them, which is exactly why nobody notices when it stops.

Make sure expiry warnings go to an address somebody reads, not to whoever set up the hosting years ago.

While someone is looking, ask them to confirm the server supports TLS 1.2. The major browsers have said they will drop the older versions, 1.0 and 1.1, early next year.

The counter-case

For some businesses EV still makes sense.

A business whose contracts, insurers or partners require it should keep it. So should one often imitated by fraudulent sites, where a verified record of the real company helps when customers ask which site is genuine.

Some organisations simply prefer the stricter checks, and the record they leave, whatever browsers display.

For most small business sites, though, a certificate that renews itself, and pages that show plainly who you are, now do more than a name few visitors will see.

Before the renewal date

  1. Find the certificate's expiry date and type.
  2. Check whether any contract requires EV.
  3. Look at where payments actually happen.
  4. Confirm the certificate covers every address in use.
  5. Send expiry warnings to an address somebody reads.
  6. Check the server supports TLS 1.2.
  7. Show your full name and address on every page.

Step two decides everything else. If nothing requires an EV certificate, the renewal becomes a question of cost and convenience; if something does, keep it and stop worrying about the address bar.

Installing any certificate properly, with its redirects and settings, is covered in moving a site to HTTPS properly.

Frequently asked questions

What did Chrome 77 change?

It no longer shows the company name from an Extended Validation certificate beside the address. The name now appears only in the panel that opens when somebody clicks the padlock.

Is my site less secure now?

No. An EV certificate encrypts the connection exactly as before, and exactly as other certificates do. Only what Chrome displays has changed.

How do the certificate types differ?

In how much the issuer checked: domain validated proves control of the domain, while organisation and extended validation also check the business. All three encrypt identically.

Do visitors look at certificate details?

Rarely. They judge the page itself, notice browser warnings such as Not secure, and sometimes check the address. Few ever open the certificate panel.

Should I renew an EV certificate?

Keep it if a contract, insurer or partner requires it. Otherwise a certificate that renews automatically, with your full name and address on every page, usually serves better.

What else should I check at renewal?

That the certificate covers every address in use, that expiry warnings reach somebody who reads them, and that the server supports TLS 1.2 before older versions are dropped.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

EV certificate renewal coming up?

Send us the renewal notice. We will check what requires it and what your site actually needs.

Start a Conversation