The certificate had been purchased years earlier, back when the company was small enough that every visible trust signal felt worth paying for, and Extended Validation certificates still displayed a distinct green company-name indicator in most browsers' address bars. It had simply been renewed every year since, without much reconsideration, because "our SSL certificate" was one of those recurring line items nobody wanted to be the one to accidentally break.
What prompted a second look
A routine budget review surfaced it as one of several small recurring vendor costs worth re-justifying rather than auto-renewing. The honest answer, once someone actually checked, was that the specific visual EV indicator the certificate had originally been bought for had been removed from every major browser years earlier — the certificate was still doing its core job (encrypting traffic, proving domain control), but the specific extra visual trust signal that justified the extra cost no longer existed in any browser a visitor would actually be using.
The actual decision process
The team's hesitation wasn't really about the money — it was a nagging worry that switching to a free, automated DV certificate might look less trustworthy to existing enterprise customers, some of whom had specifically negotiated security-conscious contracts. That concern turned out to be worth directly validating rather than assuming: a quick, honest internal check confirmed none of their actual customer contracts referenced certificate validation level at all, only that traffic be encrypted and the certificate be valid and current — requirements a DV certificate satisfies identically to an EV one from a pure encryption standpoint.
What actually changed
The migration itself was almost anticlimactic after all that deliberation: a Let's Encrypt certificate, automated renewal via Certbot, done within an afternoon. No customer ever raised it. The $400 line item disappeared from the next year's budget, and the certificate renewal stopped being something a human needed to remember to do at all.
The actual lesson, separate from the specific dollar amount
The interesting part of this story isn't really "EV certificates are unnecessary" as a blanket claim — for specific enterprise, financial, or regulatory contexts, OV or EV validation still serves a real purpose (see our DV vs OV vs EV guide for when it genuinely matters). The actual lesson was narrower: a recurring cost that was originally justified by a specific, concrete feature is worth re-checking against whether that feature still exists at all, rather than assuming the original justification still holds just because nobody's revisited it.
This case study is written to illustrate a genuine, common troubleshooting pattern. It is not a direct quotation or a verified account tied to a specific, identifiable individual or company. For the underlying technical reference, see: DV vs OV vs EV Certificates · Free vs Paid SSL
Loading comments…