Trade names in Extended Validation SSL Certificates

VeriSign's Tim Callan has posted short article on how trade names are included in an EV SSL Certificate. As long as a company has a legally registered trade name (e.g. "assumed name" or "DBA name"), the EV guidelines allow it to be put into organization name field of the certificate as follows:

In addition, an assumed name or d/b/a name used by the Subject MAY be included at the beginning of this field, provided that it is followed by the full legal organization name in parenthesis. If the combination of the full legal organization name and the assumed or d/b/a name exceeds 64 characters, as defined by RFC 3280, the CA SHOULD use only the full legal organization name in the certificate.

Tim Callan explained it like this, giving the example of HSBC:

As I discuss EV SSL with a variety of online businesses, one question I get a lot is about the name that appears adjacent to the address bar in compatible browsers. The question goes something like this, "We do business under the well-known brand of HipCoolStuff, but our company is actually called Old Stodgy Holding Corporation. We don't want the Old Stodgy name on our Web site. Nobody knows us by that name, and it's not the brand identity we choose to present to the public. What can we do about that?"

The answer is that you're allowed to use any legal trade name that you possess in that address bar. A business may obtain EV certificates under an organization name that is a legally registered trade name of the organization in question (referred to in the EV guidelines as "Assumed Name"). VeriSign or the other CA must authenticate the legal status of that trade name as a valid name registered to the Organization before we are allowed to issue the certificate. Then when the certificate appears on the site, you will see the trade name first and then a parenthetical note with the legal name of the organization. For example, HSBC also owns the first direct Internet bank. On the first direct site, the organization name is not "HSBC Holdings." Rather it is "first direct Bank (HSBC Holdings plc)."

Trade names in Extended Validation SSL Certificates - [Tim Callan's SSL Blog]

Originally posted on Sun Oct 19, 2008