DV, OV, EV and wildcard: which SSL certificate do you need?

Start with the thing the sales pages bury: every certificate on this page encrypts your traffic identically. There is no stronger padlock. The price difference buys identity verification and hostname coverage, and nothing else.

The three validation levels

Domain Validated (DV) proves you control the domain, usually by responding to an email or placing a file on the server. Issued in minutes, automatable, and correct for the overwhelming majority of sites - blogs, brochure sites, most shops, internal tools.

Organisation Validated (OV) additionally verifies that your company exists: registration documents, a check against a public directory, sometimes a phone call. Takes a day or three. The company name appears in the certificate details, which nobody looks at, but some procurement and compliance processes require it in writing.

Extended Validation (EV) is a stricter version of the same verification. It used to turn the browser bar green with your company name in it - that has been removed from every major browser, which removed most of the practical argument for it. Buy it if a contract or a regulator names it. Otherwise it is expensive OV.

Coverage: how many hostnames

Single domain covers one hostname, and issuers conventionally include the www and non-www pair. Right for one site.

Wildcard covers *.yourdomain.com - every direct subdomain, including ones you have not created yet. If you run shop., blog., app., mail. and staging., a wildcard is both cheaper and much less to administer than five certificates with five expiry dates. Note that it covers one level: *.yourdomain.com does not cover a.b.yourdomain.com.

Multi-domain (SAN) covers several different domains on one certificate. Useful when one server hosts yourbrand.com, yourbrand.in and a couple of campaign domains.

Choosing, in one paragraph

A normal site: DV, single domain. A site with several subdomains: DV wildcard. A business whose customers or auditors want a verified legal identity: OV, wildcard if the subdomains warrant it. EV only when something in writing names it.

Three things that go wrong

• Expiry. A lapsed certificate throws a full-page browser warning, and it always happens on a weekend. Note the date, or use automatic renewal.
• Mixed content. The certificate is installed and the padlock still does not appear, because an image or a script is being loaded over plain HTTP. Find it in the browser console and fix the URL.
• Only half the site redirected. HTTPS working is not the same as HTTP being redirected to it. Force the redirect for both www and non-www.

Free DV certificates are included and renewed automatically on our hosting plans, so most customers need nothing from this page. We sell OV and wildcard certificates for the cases where a free DV genuinely is not enough - and we will tell you when it is.