Tools Learn Login Sign up
Home / Learn / Certificate Types Explained
Last reviewed 15 July 2026 · by MySSL Security Research

SSL Certificate Types: Which One Do You Need?

SSL/TLS certificates differ in two independent ways: how much the CA verifies about you (DV, OV, EV) and how many hostnames they cover (single-name, wildcard, multi-domain/SAN). Every type delivers identical encryption strength. For the large majority of sites the right answer is a free, automated DV certificate; pay for OV or EV only when a contract, regulator, or auditor demands verified organisation identity.

At a glance
What it is
DV, OV, EV set how much the CA verifies about you; wildcard and SAN set how many hostnames a cert covers.
Why it matters
Pick the wrong type and you overpay for identity vetting you don't need — or fail an auditor who demands it.
Key fact
Every type delivers identical encryption strength; validation level changes trust signals, not cryptographic security.
Do this
For most sites, use a free, automated DV certificate; reserve OV or EV for verified-identity requirements.
Validity periods are getting shorter. Following CA/Browser Forum Ballot SC-081v3 (approved April 2025), public TLS certificates have been capped at 200 days since 15 March 2026, drop to 100 days on 15 March 2027, and 47 days on 15 March 2029. Domain-control validation reuse shrinks further still — to just 10 days in 2029. Whichever type you buy, plan for fully automated issuance and renewal. Details in our ACME & 47-day certificates guide.

Validation Levels

SSL certificates are categorized by how thoroughly the Certificate Authority (CA) verifies the certificate requester's identity.

Domain Validation (DV)

The most basic type. The CA only verifies that you control the domain — no identity verification.

Verified by:

  • Email to admin@yourdomain.com
  • DNS TXT record
  • HTTP file on your server

Best for:

  • Personal blogs and websites
  • Small business sites
  • Internal applications
  • Development/staging environments

Minutes Free – $100/yr

Organization Validation (OV)

Medium level of trust. The CA verifies that your organization legally exists and controls the domain.

Verified by:

  • Domain control verification (like DV)
  • Business registration documents
  • Phone verification call
  • Physical address verification

Best for:

  • Corporate websites
  • Public-facing business applications
  • Government sites
  • Educational institutions

1–3 days $50 – $300/yr

Extended Validation (EV)

Highest level of trust. Requires thorough vetting of the organization's legal, physical, and operational existence.

Verified by:

  • All OV requirements plus:
  • Legal existence (government records)
  • Operational existence (active business)
  • Physical address confirmation
  • Verified phone number callback
  • Domain ownership legal agreement

Best for:

  • E-commerce sites
  • Financial institutions
  • Healthcare organizations
  • Any site handling sensitive data

1–2 weeks $100 – $500/yr

Note: While EV certificates used to show a green address bar with company name, most browsers have removed this visual indicator. EV still provides the highest validation level, and company information is viewable in certificate details.

Coverage Types

Beyond validation level, certificates also differ in which domains they cover.

Single domain

Covers exactly one domain — the most basic and affordable option.

www.example.com

Wildcard

Covers a domain and all its first-level subdomains using *.domain.com notation.

*.example.com = www.example.com mail.example.com api.example.com
Not covered: example.com (root) sub.sub.example.com

Multi-domain (SAN)

Uses Subject Alternative Names to cover multiple different domains with one certificate.

example.com example.org example.net brand.io

Best for: Microsoft Exchange / Office 365, multiple brands, Unified Communications, multi-tenant apps.

Multi-domain wildcard

The most flexible option — combines wildcards with SAN to cover multiple domains and all their subdomains.

*.example.com *.example.org example.com example.org
Tip: If you need the root domain covered by a wildcard, many CAs include both *.example.com and example.com in the same certificate.

Comparison Table

Type Validation Time Cost Best For
DV Domain only Minutes Free - $100 Blogs, personal sites
OV Organization 1-3 days $50 - $300 Business sites
EV Extended 1-2 weeks $100 - $500 E-commerce, finance
Wildcard DV or OV Varies $100 - $500 Many subdomains
Multi-Domain DV, OV, or EV Varies $100 - $600 Multiple brands

Free SSL Certificates

Several providers offer free DV certificates:

  • Let's Encrypt: Automated, free DV certificates, currently 90-day default validity — but that default is scheduled to shorten to 64 days on 10 February 2027 and 45 days on 16 February 2028. An opt-in tlsserver profile has issued 45-day certificates since 13 May 2026, and an opt-in shortlived profile issues 6-day certificates (160 hours) — generally available since 15 January 2026, along with certificates for bare IPv4/IPv6 addresses. Short-lived certs are exempt from carrying OCSP/CRL revocation information under the Baseline Requirements. Note: since 8 July 2026 Let's Encrypt certificates no longer support TLS client authentication — they are server-auth only. See our ACME & 47-day certs guide.
  • Cloudflare: Free SSL for sites using their CDN; also offers short-lived origin certificates.
  • AWS Certificate Manager: Free for use with AWS services; rotates certificates automatically.
  • Google Trust Services: Free ACME-issued certificates for any domain.
  • ZeroSSL: Free DV certificates with easy issuance.
Recommendation: For most websites, a free DV certificate from Let's Encrypt combined with proper TLS configuration provides excellent security. Use OV or EV when you need to display verified organization identity.
Ready to Get a Certificate?
Generate a Certificate Signing Request (CSR) with our free tool. Choose RSA or ECDSA, add SANs, and download your CSR and private key instantly.
Open CSR Generator →

Choosing the Right Certificate

Walk through these questions to land on the right type:

1

Do you handle financial transactions?

Consider EV or OV for verified organization identity.

2

Do you have many subdomains?

A wildcard certificate is more economical than buying many singles.

3

Do you have multiple brands or domains?

A multi-domain SAN certificate covers them all at once.

4

Is it a personal project?

A free DV certificate is perfect — fast and zero cost.

5

Do you need to display organization info?

OV or EV is required to show verified company details.

Related Articles

Report a bug

We're new and growing — your feedback helps us improve.

Click to upload, or paste (Ctrl+V) an image