DV Certificate (Domain Validated certificate)

A DV (Domain Validated) certificate is the most basic kind of publicly trusted TLS certificate. Before issuing it, the certificate authority only checks that the applicant controls each domain name in the request, using a domain control validation method such as serving a token file from the website or publishing a DNS TXT record. The certificate's subject therefore contains just the domain name, with no organization name or address.

Why it matters

Because no human review of documents is needed, DV certificates can be issued in seconds and fully automated with ACME. That is why free CAs such as Let's Encrypt issue only DV certificates, and why DV fits the shrinking maximum lifetimes adopted by the CA/Browser Forum: 200 days for certificates issued from 15 March 2026, falling to 47 days from 15 March 2029. Reuse of domain validation data shrinks on the same schedule, down to 10 days in 2029, so manual DV workflows become impractical. Since 2025, CAs must also perform the domain check from multiple network vantage points (MPIC), which makes it harder to trick a CA with a local network hijack.

Example

Inspecting a DV certificate shows only a common name in the subject:

openssl x509 -in example.com.crt -noout -subject
# subject=CN = example.com

Common misconceptions

• DV certificates encrypt less strongly. Encryption strength depends on the key and the negotiated cipher suite, not the validation level; DV, OV and EV connections are cryptographically identical.
• A DV padlock means the site is legitimate. DV proves only control of the domain at issuance time; phishing sites can and do obtain DV certificates.
• Free DV certificates are not trusted everywhere. The major free DV issuers are included in all mainstream browser and operating system trust stores.