SSL Certificate Types Explained: DV, OV and EV Compared

Every valid SSL certificate encrypts the connection the same way. The SSL certificate types differ in what the certificate authority (CA) checked about the owner before it issued the certificate. This guide explains the three validation levels, shows a real certificate of each type, and shows how to check which type a site uses.

Quick Answer: There are three types of SSL certificates by validation level. DV (Domain Validation) proves control of the domain and is issued in minutes, often for free. OV (Organization Validation) adds a check of the organization's identity and address, and puts the organization name in the certificate. EV (Extended Validation) adds stricter legal, physical and operational checks. Encryption is the same for all three. To see which type a site uses, enter it into our SSL checker.

How SSL certificate validation works

Before a CA issues a certificate, it validates the request. The rules come from the CA/Browser Forum: the Baseline Requirements cover DV and OV, and the EV Guidelines cover EV. Each certificate carries a policy object identifier (OID) that records its validation level:

A fourth, rarely used level is IV (Individual Validation, 2.23.140.1.2.3), which names a person instead of an organization.

Three real certificates, one of each type

The three certificates below come from openssl, checked on 12 October 2026. The command prints the subject (who the certificate is for), the issuer and the policy OIDs:

echo | openssl s_client -connect paypal.com:443 -servername paypal.com 2>/dev/null \
  | openssl x509 -noout -subject -issuer -ext certificatePolicies

DV: wikipedia.org

subject=CN=*.wikipedia.org
issuer=C=US, O=Let's Encrypt, CN=YE2
X509v3 Certificate Policies:
    Policy: 2.23.140.1.2.1

The subject is only a hostname, here a wildcard. Nothing in it names the Wikimedia Foundation.

OV: paypal.com

subject=C=US, ST=California, L=San Jose, O=PayPal, Inc., CN=paypal.com
issuer=C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
X509v3 Certificate Policies:
    Policy: 2.23.140.1.2.2

The subject adds the organization (O=PayPal, Inc.) and its location.

EV: bankofamerica.com

subject=jurisdictionC=US, jurisdictionST=Delaware, businessCategory=Private Organization, serialNumber=2927442, C=US, ST=North Carolina, L=Charlotte, O=Bank of America Corporation, CN=bankofamerica.com
issuer=C=US, O=DigiCert Inc, CN=DigiCert EV RSA CA G2
X509v3 Certificate Policies:
    Policy: 2.16.840.1.114412.2.1
    Policy: 2.23.140.1.1

The EV subject adds the jurisdiction of incorporation, the business category and the company registration number. The 2.16.840.1.114412.2.1 OID is DigiCert's own EV policy, listed next to the CA/Browser Forum one.

DV certificates: Domain Validation

A DV (Domain Validation) certificate proves that whoever requested it controls the domain. The CA checks nothing about the person or company behind it.

How DV validation works

The CA sends a random value, and the applicant proves control by placing it where only the domain owner can:

1. DNS: a TXT or CNAME record with the value (see DNS records explained)
2. HTTP: a file with the value at a fixed URL on the web server
3. TLS-ALPN: a special certificate served on port 443 during the check

Let's Encrypt supports all three as the ACME challenges HTTP-01, DNS-01 and TLS-ALPN-01. Wildcard certificates such as *.wikipedia.org need the DNS method.

CAs are phasing out email validation to addresses such as admin@ or webmaster@ at the domain. The Baseline Requirements (section 3.2.2.4.4) say CAs should not use it from 15 March 2026 and must not rely on it from 15 March 2028.

Who issues DV certificates

Let's Encrypt issues only DV certificates, for free, valid for 90 days by default. It does not issue OV or EV certificates, because their checks cannot be automated. Commercial CAs sell DV certificates too. The github.com certificate, for example, is a DV certificate from Sectigo.

When DV is enough

DV fits most websites: blogs, company sites, SaaS apps and online shops. It gives the same encryption as OV and EV, and browsers show it the same way. Large sites use it too. On 12 October 2026, github.com, google.com and wikipedia.org all served DV certificates.

OV certificates: Organization Validation

An OV (Organization Validation) certificate adds the organization's name and location to the certificate. The CA checks that the organization exists and that the address is real.

How OV validation works

Section 3.2.2.1 of the Baseline Requirements lets the CA verify the organization's identity and address through one of these sources:

• A government agency in the organization's jurisdiction, such as a company register
• A regularly updated third-party database the CA treats as reliable
• A site visit by the CA or its agent
• An attestation letter, for example from a lawyer or accountant

The CA also validates the domain, the same way as for DV. Because a person reviews the documents, OV issuance takes longer than DV, and CAs charge for it.

What OV certificates show

The organization appears in the certificate's subject, as O=PayPal, Inc. above. Browsers show an OV certificate the same way as a DV one. You see the difference only in the certificate details or in tools that read the subject. Our SSL checker, for example, lists the organization next to the common name.

When to use OV

OV makes sense when you want the company name inside the certificate, for audits, partner requirements or internal policy. On 12 October 2026, paypal.com, microsoft.com and wellsfargo.com served OV certificates.

EV certificates: Extended Validation

An EV (Extended Validation) certificate follows the strictest process. The EV Guidelines (section 3.2.2.1.1) require the CA to verify:

1. The organization's legal existence and identity, for example in a government company register
2. Its physical existence: a business presence at a physical address
3. Its operational existence, for example through records of at least three years of existence, a listing in a qualified business database, or a bank account confirmed by a regulated bank
4. A reliable way to contact the organization
5. The name, title and authority of the people who sign the agreement and approve the request

EV certificates cannot cover wildcard names. Each hostname must be listed on its own (the only exception is .onion addresses).

What happened to the green address bar

Browsers used to show the company name of an EV certificate in a green bar next to the address. Chrome moved that information into the Page Info panel behind the lock icon in Chrome 77, released in 2019. Firefox did the same in Firefox 70 the same year. Today an EV site looks the same as a DV site in the address bar. The difference shows only in the certificate details.

When to use EV

Banks and some large companies still buy EV certificates. On 12 October 2026, bankofamerica.com, chase.com, apple.com and stripe.com all served EV certificates. EV makes sense when a regulator, auditor or contract asks for it. It does not change what visitors see, as the green address bar section explains.

Wildcard and multi-domain certificates

Certificates also differ in which hostnames they cover:

DV and OV certificates can be wildcards. EV certificates cannot. Most certificates are multi-domain in practice: the github.com certificate lists both github.com and www.github.com.

How long certificates of any type last

DV, OV and EV certificates follow the same validity rules. The CA/Browser Forum's ballot SC-081, passed on 11 April 2025, cuts the maximum lifetime in steps:

The 200-day limit applies today. The paypal.com certificate above runs from 24 September 2026 to 10 April 2027, 198 days. The same ballot shortens how long a CA may reuse a domain check before it must validate again. Automated renewal through ACME is now the normal setup for every certificate type.

How to check a website's certificate type

Use an SSL checker

Enter the domain into our SSL checker. If the result shows an Organization, the certificate is OV or EV. If there is only a common name, it is DV. The issuer name often names the level too: "DigiCert EV RSA CA G2" contains EV, and "Sectigo Public Server Authentication CA DV E36" contains DV. The full hosting check shows the same certificate details next to the DNS records and the hosting provider.

Inspect it in your browser

1. Click the icon left of the address bar (a tune icon in Chrome, a padlock in Firefox).
2. Open the connection details and then the certificate viewer.
3. Look at the Subject. Only CN means DV. An O field means OV or EV. Jurisdiction and registration number fields mean EV.

Use the command line

Only the policy OID reliably separates OV from EV:

echo | openssl s_client -connect bankofamerica.com:443 -servername bankofamerica.com 2>/dev/null \
  | openssl x509 -noout -text | grep -E "Subject:|Policy:"

        Subject: jurisdictionC=US, jurisdictionST=Delaware, businessCategory=Private Organization, serialNumber=2927442, C=US, ST=North Carolina, L=Charlotte, O=Bank of America Corporation, CN=bankofamerica.com
                Policy: 2.16.840.1.114412.2.1
                Policy: 2.23.140.1.1

2.23.140.1.1 marks EV, 2.23.140.1.2.2 OV and 2.23.140.1.2.1 DV. For more ways to check a certificate, including curl and the common errors, see how to check if a website has SSL.

Choosing the right certificate type

For most websites, a free DV certificate with automatic renewal is the right choice. Pick OV when you need the organization named in the certificate. Pick EV only when a regulator, auditor or contract asks for it.

Frequently Asked Questions

Is a free DV certificate less secure than a paid EV certificate?

No. Both use the same TLS protocol and the same ciphers, so the encryption is identical. The difference is how much the CA checked about the owner before issuing the certificate.

Do I need an EV certificate for e-commerce?

No. Payment card rules require encrypted connections, not a particular validation level. Large shops run on DV and OV certificates. EV no longer changes what shoppers see in the address bar.

Can I switch from DV to OV or EV without downtime?

Yes. Order the new certificate while the old one is still valid, then install it in place of the old one. Visitors see no interruption.

Why did browsers remove the green bar for EV certificates?

Chrome's security team found that the EV indicator did not protect users as intended. People did not make safer choices when it was missing. Chrome moved it out of the address bar in Chrome 77 and Firefox in Firefox 70, both in 2019.

How can I tell if a site uses DV, OV or EV?

Check the certificate subject. Only a hostname means DV. An organization name means OV or EV. To be sure, read the policy OID with openssl: 2.23.140.1.1 is EV and 2.23.140.1.2.2 is OV.

Wrapping up

All three SSL certificate types encrypt the same way. They differ in what the CA checks: domain control for DV, the organization for OV, and stricter legal checks for EV. A free DV certificate with automatic renewal fits most sites. To see which type a site uses, enter its domain into our SSL checker.

Related articles

• SSL Certificate Checker: How to Check If a Website Has SSL
• DNS Records Explained
• Where Is This Website Hosted? How to Find Out
• Website IP Lookup: How to Find Your Website's IP Address