Types of SSL Certificates:DV, OV, EV and Wildcard
DV, OV, EV, wildcard and multi-domain certificates compared: what each one validates, what visitors actually see, when a free certificate is enough and when a paid one makes sense.
Table of Contents
SSL/TLS certificates differ in two ways: how much the certificate authority checks about you (domain validation, organisation validation or extended validation) and how many names the certificate covers (one domain, a wildcard for all subdomains, or several domains). All of them provide the same strength of encryption. For most websites, a free, automatically renewed domain-validated (DV) certificate is enough.
Validation levels
| Type | What the CA verifies | Issuance time | Typical cost |
|---|---|---|---|
| DV (Domain Validation) | That you control the domain | Minutes, automated | Free or low |
| OV (Organization Validation) | Domain control plus that the organisation exists | Days | Paid |
| EV (Extended Validation) | Stricter checks on the organisation's legal identity | Days to weeks | Paid, higher |
Domain validation (DV)
The CA checks control of the domain, usually by placing a file on the website or a DNS record. Free authorities such as Let's Encrypt issue DV certificates, and hosting control panels can issue and renew them automatically.
Suits: blogs, business websites, online stores and most applications.
Organization validation (OV)
The certificate includes verified organisation details, visible if someone inspects the certificate.
Suits: organisations with policies requiring it, B2B services where partners inspect certificates.
Extended validation (EV)
EV involves the most thorough checks. Browsers used to show the company name prominently in the address bar for EV certificates, but major browsers removed that special display several years ago, so most visitors will not see a difference.
Suits: organisations with specific compliance or policy requirements.
Coverage options
| Coverage | Covers | Example |
|---|---|---|
| Single domain | One hostname (often with and without www) | example.com, www.example.com |
| Wildcard | All first-level subdomains of one domain | *.example.com covers shop.example.com, mail.example.com |
| Multi-domain (SAN) | A list of different names | example.com, example.net, shop.example.org |
Notes:
- A wildcard covers one level only:
*.example.comdoes not covera.b.example.com. - Wildcard DV certificates usually require DNS validation.
- Multi-domain certificates are convenient but must be reissued when names are added.
Free vs paid certificates
Free certificates provide the same encryption and browser trust as paid DV certificates. They have short lifetimes and rely on automatic renewal, which hosting panels handle.
Paid certificates can make sense when you need OV/EV validation, specific warranties, longer support, or certificates for systems that cannot automate renewal. Note that maximum certificate lifetimes are shrinking for all publicly trusted certificates (see what is SSL/TLS and how does HTTPS work), so even paid certificates need renewal more often than in the past.
How to choose
- Standard website or shop? A free DV certificate with automatic renewal.
- Many subdomains? A wildcard certificate, or individual automatic certificates per subdomain.
- Several separate domains on one server? Individual certificates or a multi-domain certificate.
- Policy requires verified organisation details? OV or EV.
Installing and renewing
On cPanel hosting, AutoSSL or a Let's Encrypt integration usually issues and renews certificates automatically; see how to install a free SSL certificate in cPanel. On a VPS, an ACME client (such as Certbot) does the same job. Whatever you use, monitor expiry dates.
Worked examples: which certificate setup?
| Situation | Sensible choice | Why |
|---|---|---|
Business site at example.com and www.example.com |
Free DV certificate with automatic renewal | Covers both names; renewal is automatic |
Shop with shop., blog. and help. subdomains on one server |
Automatic certificates per name, or one DV wildcard (*.example.com) |
Wildcard needs DNS validation; per-name certificates are simpler with AutoSSL |
| Agency hosting 20 client domains on one VPS | One automatic certificate per domain | Each client's domain renews independently; no shared key |
| Bank-facing B2B portal where policy requires verified organisation details | OV certificate, renewed through a process you automate | Meets the policy requirement; same encryption |
| Internal device or appliance that cannot automate renewal | Paid certificate with the longest allowed validity, plus reminders | Shorter maximum lifetimes mean renewals still come round regularly |
What to check when you buy a paid certificate
- Which names it covers, and whether adding names later requires reissuing.
- The validation process and documents needed (for OV and EV).
- Support for automation through ACME, so renewals do not depend on someone remembering.
- How reissuing works if the private key is lost or compromised.
Remember that a certificate's price says nothing about encryption strength; the protocol and server configuration decide that.
Checking a site's certificate
In most browsers, click the padlock (or site information icon) → connection is secure → certificate details. You will see:
- Issued to: the names covered;
- Issued by: the certificate authority;
- Valid from / to: the dates;
- for OV/EV certificates, the organisation details.
From a terminal, openssl s_client -connect example.com:443 -servername example.com shows the certificate chain served by a server.
Frequently Asked Questions
Does an EV certificate improve SEO?
No. Search engines treat HTTPS sites equally regardless of validation level.
Do I need a separate certificate for www?
Most certificates cover both example.com and www.example.com. Check that both names are included.
Can I use one certificate on several servers?
Yes, if it covers the names those servers use, but copying private keys between servers increases risk. Automated per-server certificates are often simpler.
Related reading
HTTPS is part of website security basics. Free SSL is included with the ServerNeed shared hosting plans.
Sources
Last updated 7 October 2026
