TLS certificates, still usually called SSL certificates, differ in two ways. Validation level says what the authority checked: DV proves control of the domain, OV adds a check of the organisation, EV adds a stricter one. Coverage says which names it secures: one name, a wildcard for one level of subdomains, or a list of names.
| Level | What is checked | Fully automatable? | Encryption strength |
|---|---|---|---|
| DV (domain validated) | Control of the domain, by DNS record, file or email | Yes | Same as OV and EV |
| OV (organisation validated) | Domain control plus the organisation's legal existence | No | Same as DV |
| EV (extended validation) | Domain control plus a stricter identity and address check | No | Same as DV |
Updated
Certificate sellers list many products, but the choices reduce to how much identity checking you want and how many names you need covered. Answer three questions in the picker below to get a sensible recommendation, then read what each type really changes for visitors.
| Type | Covers | Does not cover |
|---|---|---|
| Single name | example.com only | www.example.com, shop.example.com |
| Wildcard *.example.com | www.example.com, shop.example.com | example.com, a.shop.example.com |
| Multi-domain (SAN) | Each name listed, e.g. example.com, www.example.com, example.org | Any name not on the list |
Certbot is a free ACME client maintained by the EFF. Manual mode prints a TXT value to add at _acme-challenge.example.com and cannot renew on its own without a hook script, so use a DNS plugin for unattended renewals.
sudo certbot certonly --manual --preferred-challenges dns \
-d example.com -d "*.example.com"These records let Let's Encrypt issue both normal and wildcard certificates and block every other authority.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issuewild "letsencrypt.org"All three levels use the same algorithms and key sizes, so the connection is equally private. What changes is the identity information inside the certificate and how long issuance takes.
Because address bars no longer highlight EV, the visible benefit of paying for it has mostly gone. Some organisations still buy OV or EV because a procurement rule asks for it.
A single-name certificate covers exactly one hostname. A multi-domain certificate lists several names in its Subject Alternative Name field, which may belong to unrelated domains.
A wildcard matches any one label in its position. One wildcard key copied to many servers is a bigger loss if it leaks, so separate certificates per service can be the safer choice.
A domain validated certificate proves only that whoever requested it controlled the domain at that moment, shown by placing a DNS record or a file, or answering an email. It encrypts traffic exactly as well as costlier types and is what most websites use.
No. Chrome moved the EV details out of the address bar into the page info panel, opened from the icon beside the URL, in version 77. Visitors see the same address bar for DV, OV and EV sites.
Yes. Let's Encrypt is a nonprofit authority whose DV certificates are trusted by major browsers and encrypt the same way as paid ones. It does not issue OV or EV certificates and says it has no plans to.
Let's Encrypt certificates last 90 days, with an opt-in six day option. For publicly trusted certificates in general, the CA/Browser Forum ballot SC-081 cuts the maximum from 398 days down to 47 days in stages ending in March 2029.
A DV certificate covering the bare domain and www is enough for almost every small site, including shops that take card payments through a hosted checkout. OV or EV mainly matter when a contract or policy requires named identity in the certificate.
Related: DNS record types, How to add a custom domain, Domain vs hosting, What a CDN does, DNS lookup tool.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.