There are three validation levels, they cost very different amounts, and the difference is not encryption. Every level encrypts identically. What differs is what the certificate authority verified before issuing.
DV — Domain Validation
Proves that whoever requested the certificate controls the domain. Issued in minutes, automatically. Verifies nothing about the organisation behind it.
Right for: blogs, brochure sites, internal tools, staging environments, anything not handling payments or personal data.
OV — Organisation Validation
The CA verifies that your company legally exists — registration records, address, a phone check. Takes a day or two. Your verified company name appears in the certificate details.
Right for: business websites, customer portals, anything collecting personal data, most e-commerce.
EV — Extended Validation
The most thorough vetting: legal existence, physical presence, operational history, signing authority. Takes up to a week and costs the most.
Worth noting honestly: browsers removed the green address bar years ago, so the visible payoff is smaller than it was. EV still makes sense for banks, large financial platforms, and organisations that are frequently impersonated — the verified identity in the certificate is the value, not a UI badge.
The two shape decisions
- Wildcard — covers *.yourdomain.com. One certificate, unlimited subdomains at one level. Right when you keep adding subdomains.
- Multi-domain (SAN) — covers several different domains on one certificate. Right when you run multiple brands.
The mistake that actually costs money
Not choosing the wrong level. Letting one expire. An unnoticed expiry takes production down and erodes trust in a way that no validation level compensates for. If you have more than a handful of certificates, use lifecycle management with automated renewal and stop tracking them in a spreadsheet.
Not sure what you are running? We will audit your certificate estate — most organisations find around 30% more certificates than they knew about.