SSL Certificate Types Explained: DV, OV, and EV
Not all SSL certificates are created equal. While they all encrypt traffic between a browser and a server, they differ significantly in how much identity verification the Certificate Authority (CA) performs before issuing the certificate. Understanding the three certificate types — Domain Validated (DV), Organisation Validated (OV), and Extended Validation (EV) — helps you choose the right one for your use case.
Domain Validated (DV) Certificates
A Domain Validated certificate is the most basic type. The Certificate Authority only verifies that the applicant controls the domain — it performs no checks on the organisation behind it. Verification is typically automated via one of three methods: placing a specific file on the web server, adding a DNS TXT record, or responding to an email sent to a domain-specific address.
DV certificates are issued within minutes and are the cheapest option — often free from providers like Let's Encrypt, ZeroSSL, and Cloudflare. They are perfectly adequate for:
- Personal websites and blogs
- Developer and staging environments
- Internal tools and dashboards
- APIs that don't process sensitive user data
The padlock icon in browsers looks identical regardless of certificate type, so users cannot visually distinguish a DV certificate from an OV or EV one without inspecting the certificate details.
Organisation Validated (OV) Certificates
Organisation Validated certificates require the CA to verify both domain ownership AND the legal existence of the organisation. This involves checking business registration records, verifying the organisation's address, and sometimes making phone contact. Issuance typically takes 1–3 business days.
OV certificates embed organisation details (company name, location) into the certificate itself, which is visible to users who inspect the certificate. This provides stronger trust assurance than DV. OV certificates are appropriate for:
- Business websites and corporate portals
- Login and authentication pages
- Public-facing APIs and web services
- Software download sites where code signing trust matters
Extended Validation (EV) Certificates
Extended Validation certificates undergo the most rigorous vetting process. CAs follow strict guidelines set by the CA/Browser Forum to verify the organisation's legal identity, physical existence, operational existence, and authorisation. This process typically takes 1–5 business days.
Historically, EV certificates displayed the company name in the browser address bar in green. Major browsers (Chrome, Firefox, Safari) removed this visual distinction between 2019 and 2020, citing that it provided marginal security benefit while adding complexity. Today, EV certificates still embed organisation details and have value in regulated industries and high-security environments:
- Financial institutions and banking portals
- Healthcare organisations handling patient data
- E-commerce sites processing high transaction volumes
- Government and regulatory websites
Comparison Table
| Feature | DV | OV | EV |
|---|---|---|---|
| Verification | Domain only | Domain + Org | Domain + Org + Enhanced |
| Issue time | Minutes | 1–3 days | 1–5 days |
| Cost | Free – $100/yr | $50–$400/yr | $100–$800/yr |
| Org in cert | No | Yes | Yes (strict) |
| Browser indicator | Padlock | Padlock | Padlock |
| Best for | Personal/dev | Business | Finance/regulated |
Wildcard and Multi-Domain (SAN) Certificates
Beyond validation level, certificates also differ in how many domains they cover:
Covers one specific domain (e.g. certnotify.com)
Covers a domain and all its subdomains (e.g. *.certnotify.com — covers app.certnotify.com, api.certnotify.com, etc.)
Covers multiple different domains in a single certificate using Subject Alternative Names
Wildcard and multi-domain features can be combined with any validation level.
Which Certificate Type Do You Need?
DV — Free from Let's Encrypt. No reason to pay more.
DV or OV — DV is sufficient for most SaaS products. OV if brand trust matters.
OV or EV — PCI DSS doesn't mandate EV, but OV shows organisational legitimacy.
EV — Industry expectation and regulatory guidance supports EV.
DV — No need to pay for OV/EV on non-public systems.
Monitoring Your Certificate Type
Regardless of certificate type, every SSL certificate expires. Certificate expiry is one of the most preventable causes of website downtime — yet it continues to affect organisations of all sizes. CertNotify checks your certificates once a day — validity dates, issuer, TLS version and expiry — and emails you before one expires, at the lead time you choose.
Use our free Certificate Chain Checker to see any domain's certificate issuer and every Subject Alternative Name it covers.
Related Articles
Common questions
What is the difference between DV, OV, and EV SSL certificates?
Domain Validation (DV) verifies only domain ownership — issued in minutes, free from Let's Encrypt. Organization Validation (OV) additionally verifies the organization's legal identity — takes 1-3 days. Extended Validation (EV) has the most rigorous vetting — legal, physical, and operational verification — takes 1-2 weeks and costs more.
Do I need an OV or EV certificate for my business website?
For most sites, DV provides identical encryption strength to OV and EV — the padlock looks the same. OV makes sense for financial services or high-trust contexts where the organization identity in certificate details provides additional assurance. EV no longer shows a green bar in browsers since 2019, making the premium harder to justify.
What is a wildcard SSL certificate and when should I use one?
A wildcard certificate (*.example.com) covers the root domain and all immediate subdomains (www, api, mail, etc.) with one certificate and one renewal. Use it when you have multiple subdomains to secure. It does not cover second-level subdomains like sub.api.example.com — those require either a separate wildcard or a SAN certificate.
What is a multi-domain (SAN) SSL certificate?
A SAN certificate explicitly lists multiple domains in the Subject Alternative Names field — for example, example.com, example.net, and app.example.com — secured by one certificate. This reduces management overhead when you own multiple domains. Let's Encrypt allows up to 100 SANs per certificate at no cost.
References and further reading
The specifications and primary documentation this article is based on.
- RFC 5280 — Internet X.509 Public Key Infrastructure Certificate and CRL Profile
- CA/Browser Forum
Publishes the Baseline Requirements every public CA must follow.
Read next
More guides on the same subject.