Note: Browsers have different EV policies, so simply having an "EV certificate" is not sufficient. The provider of the certificate needs to be recognized as trusted for EV, and the certificate itself needs to comply with the browser's policies about showing an EV certificate.

In this case, the certificate does not contain Certificate Transparency information, which is required to get the EV treatment (as documented at https://www.chromium.org/Home/chromium-security/certificate-transparency )

While Chrome has a whitelist of certificates that existed prior to CT becoming hard required, that whitelist must be downloaded first. If a distribution disables downloading that whitelist, as some distributions do, then only certificates that contain Certificate Transparency information, issued by a CA trusted for EV, issued in accordance with EV policies, will be recognized as EV.

I'm closing this as WAI.

> If a distribution disables downloading that whitelist
Any advice on how to install this whitelist manually?

Filed a bug to ubuntu chromuim maintainers: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1603079

The whitelist is downloaded as part of the built-in component updater. It's automatically downloaded within the first 5-30 minutes of running, and subsequently updated in the background multiple times a day.

If a distribution has disabled component updates, they will not receive this.

And you can update via chrome://components

chrome://components/ shows:

EV Certs CT whitelist - Version: 7
Status - Component not updated

I pressed "check for update", version didn't change.

Doesn't this mean update isn't disabled by distribution?

Version 7 is the latest version, and this site is within that whitelist.

The next possibility is that your distro's version of NSS is building a certificate path to a root not recognized for EV. Attaching a chrome://net-internals will determine this, as described at https://dev.chromium.org/for-testers/providing-network-details

Note: After you open chrome://net-internals and begin capturing events, it would be good to go to "Sockets" option under the dropdown and click "Flush Socket Pools", and then load the site. This will help minimize the chance of reusing cached data. You can then go back to the "Export" option under the dropdown and click Export and attach to this bug. (Don't use the back button to do this)

Here it is. Capture for loading https://online.sberbank.ru/, EV SSL certificate wasn't shown.

Deleted: net-internals-log.json 425 KB

net-internals-log.json 425 KB View Download

^^^^ grinbar wasn't shown ^^^^

OK, still a distro issue, just... a different distro issue :)

Part of the logic for a number of security features is to consider whether or not the build is "timely" - that is, was the binary being run built within some recent time. We do this because we can only assure some semblance of security if you're running a stable, up to date build. Since Chrome (official) releases are built nearly every week, sometimes many times a week, this is reasonable and appropriate to make sure you've got all of the latest critical security fixes.

In this case, the binary is indicating that it has not been updated for at least 10 weeks, meaning it is likely missing many important security updates. It's possible that your distro is building Chromium incorrectly (that is, it's failing to indicate when the binary was built), or it's possible (and perhaps more likely) that it's not shipping security updates since it was built.

Your NetLog indicates that the Chromium version is 51.0.2704.79, but the current stable Chrome version (e.g. what distros SHOULD ship if they're shipping Chromium) is 51.0.2704.106 - this is the version with all relevant security fixes in place.

Poke the maintainers of this package to downloaded the code from the latest Chrome stable release branch to package as Chromium, and EV will be restored.

It's Ubuntu 14.04 Trusty, updates and security repositories enabled.

apt-cache policy chromium-browser
chromium-browser:
  Installed: 51.0.2704.79-0ubuntu0.14.04.1.1121
  Candidate: 51.0.2704.79-0ubuntu0.14.04.1.1121
  Version table:
 *** 51.0.2704.79-0ubuntu0.14.04.1.1121 0
        990 http://mirror.yandex.ru/ubuntu/ trusty-updates/universe amd64 Packages
        990 http://security.ubuntu.com/ubuntu/ trusty-security/universe amd64 Packages
        100 /var/lib/dpkg/status
     34.0.1847.116-0ubuntu2 0
        990 http://mirror.yandex.ru/ubuntu/ trusty/universe amd64 Packages

At http://packages.ubuntu.com/search?keywords=chromium-browser&searchon=names&suite=all&section=all you can see, that 51.0.2704.79 is latest available build for any Ubuntu version.

I'll poke the maintainers.

Thank you rsleevi@, you are very helpful.