# What Is DV Certificate (Domain Validated certificate)?

> DV certificates are TLS certificates for which the CA has verified only that the applicant controls the domain name, not who the applicant is.

Source: https://ssl.sh/glossary/dv-certificate/
Last updated: 2026-11-10

A DV (Domain Validated) certificate is the most basic kind of publicly trusted TLS certificate. Before issuing it, the certificate authority only checks that the applicant controls each domain name in the request, using a [domain control validation](https://ssl.sh/glossary/dcv/) method such as serving a token file from the website or publishing a DNS TXT record. The certificate's subject therefore contains just the domain name, with no organization name or address.

## Why it matters
Because no human review of documents is needed, DV certificates can be issued in seconds and fully automated with [ACME](https://ssl.sh/glossary/acme/). That is why free CAs such as Let's Encrypt issue only DV certificates, and why DV fits the shrinking maximum lifetimes adopted by the CA/Browser Forum: 200 days for certificates issued from 15 March 2026, falling to 47 days from 15 March 2029. Reuse of domain validation data shrinks on the same schedule, down to 10 days in 2029, so manual DV workflows become impractical. Since 2025, CAs must also perform the domain check from multiple network vantage points ([MPIC](https://ssl.sh/glossary/mpic/)), which makes it harder to trick a CA with a local network hijack.

## Example
Inspecting a DV certificate shows only a common name in the subject:

```bash
openssl x509 -in example.com.crt -noout -subject
# subject=CN = example.com
```

## Common misconceptions
- **DV certificates encrypt less strongly.** Encryption strength depends on the key and the negotiated cipher suite, not the validation level; DV, [OV](https://ssl.sh/glossary/ov-certificate/) and EV connections are cryptographically identical.
- **A DV padlock means the site is legitimate.** DV proves only control of the domain at issuance time; phishing sites can and do obtain DV certificates.
- **Free DV certificates are not trusted everywhere.** The major free DV issuers are included in all mainstream browser and operating system trust stores.

## Related terms

- [OV 证书](https://ssl.sh/zh/glossary/ov-certificate/): OV 证书是 CA 在验证域名控制权之外，还核实了证书中所写组织真实合法存在的 TLS 证书。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。
- [SSL 证书](https://ssl.sh/zh/glossary/ssl-certificate/): SSL 证书是由 CA 签名的 X.509 证书，把公钥与一个或多个域名（或 IP 地址）绑定，供 TLS 客户端验证服务器身份。
- [MPIC](https://ssl.sh/zh/glossary/mpic/): MPIC 是要求 CA 从多个网络位置重复进行域名验证和 CAA 检查、只有足够多位置结果一致才签发证书的规则。