All SSL certificates encrypt traffic the same way — the difference is only in how thoroughly the certificate authority (CA) verified the site owner. Understanding these differences helps you choose the right certificate.
Comparing SSL Types
| Parameter | DV | OV | EV |
|---|---|---|---|
| Stands for | Domain Validated | Organization Validated | Extended Validation |
| What's verified | Domain only | Domain + company | Full legal-entity check |
| Issuance time | Minutes | 1–3 days | 1–2 weeks |
| Cost/year | Free–$10 | $50–$300 | $200–$1500 |
| Display | 🔒 | 🔒 + company info | 🔒 + company name |
| Best for | Blogs, services | Corporate websites | Banks, payment systems |
Domain Validated (DV)
The most common type. The CA only verifies that you control the domain — via a DNS record, a file on the server, or email. Let's Encrypt issues DV certificates for free.
Organization Validated (OV)
The CA verifies that the organization actually exists: it requests registration documents and checks the phone number through independent databases. The certificate carries the company's legal name.
Extended Validation (EV)
The strictest check: besides documents, the CA may request notarized paperwork. Browsers used to show a green address bar with the company name. Modern browsers removed that display, so EV's practical value has dropped.
Wildcard and Multi-Domain Certificates
These aren't separate validation types but extensions that apply to DV and OV:
- Wildcard (
*.example.com) — covers all subdomains at one level - SAN/Multi-Domain — one certificate for several domains (
example.com,example.net)
What to Choose on ZevsHost
All our plans include free Let's Encrypt DV certificates with auto-renewal. For corporate sites needing OV/EV — install your certificate via cPanel → SSL/TLS.
Common Errors When Issuing and Installing a Certificate
Domain validation failed: DNS record not found
NET::ERR_CERT_AUTHORITY_INVALID
SSL certificate problem: unable to get local issuer certificate
Certificate name mismatch| Message | Cause | Fix |
|---|---|---|
| Domain validation failed: DNS record not found | The CA couldn't find the TXT or CNAME record proving domain ownership — the record wasn't added, or hasn't propagated yet | Check the record with dig TXT _acme-challenge.example.com, wait for DNS propagation before retrying |
| NET::ERR_CERT_AUTHORITY_INVALID | The browser doesn't trust the CA that issued the certificate — often a self-signed certificate instead of a DV/OV/EV one from a public CA | Install a certificate from a trusted CA (such as Let's Encrypt) instead of a self-signed one |
| SSL certificate problem: unable to get local issuer certificate | The server has no intermediate certificate chain installed, only the leaf certificate | Install the full chain — the certificate together with the intermediate CA, not separately |
| Certificate name mismatch | The certificate was issued for a different domain name (for example, without www, while the site is opened with www) | Reissue the certificate with the correct SAN names, or include both domain variants in the request |
Cost and Speed: DV, OV, EV in Practice
| Parameter | DV | OV | EV |
|---|---|---|---|
| Automated issuance via ACME | Fully automated — Let's Encrypt, ZeroSSL | No, manual through the CA only | No, manual through the CA only |
| Company documents required | No | Yes, a registry extract, the company's phone number | Yes, plus notarized documents |
| Works for Wildcard | Yes, including free CAs | Yes, but more expensive and slower | Usually not offered for wildcard |
When DV Isn't Enough and You Need OV or EV
- Industry regulatory requirements (financial institutions, payment systems) explicitly require OV or EV under an agreement with a partner or processing center
- Clients or partners check the company's legal name in the certificate itself before integrating via an API — DV doesn't carry that field
- Internal company security policy requires manual identity verification before issuing a certificate, not just control over a DNS record
- You need a static "printed" certificate valid for years ahead without auto-renewal — Let's Encrypt DV certificates are issued for a maximum of 90 days and are built for automation
How to Verify an Installed Certificate
# Validity period and issuer, straight from the server
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null 2>/dev/null | openssl x509 -noout -dates -issuer
# Full certificate chain served by the server
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts </dev/null- Check the validity period (
notAfter) — for a Let's Encrypt DV certificate it must not exceed 90 days from the issue date - Confirm the issuer (
issuer) is a public trusted CA, not "self-signed" and not an internal company CA - Check that the server serves the full chain, not just the leaf certificate — otherwise some browsers and every curl/wget without extra flags will show a trust error
- Open the site in a browser and check there's no Mixed Content warning — that means part of the page's resources are still loading over HTTP
Automatic Let's Encrypt renewal and handling wildcard domains is covered in the article Let's Encrypt wildcard with auto-renewal, and the CAA record requirement for issuing a certificate with a specific CA is covered in the CAA record for SSL.