OV Certificate (Organization Validated certificate)

An OV (Organization Validated) certificate is a TLS certificate whose subject identifies a verified organization in addition to the domain. Besides the domain control validation required for every publicly trusted certificate, the CA checks that the organization legally exists, typically against government business registries or other reliable sources, and confirms that the applicant is authorized to request the certificate. The subject then carries fields such as organization (O), locality (L), state (ST) and country (C), and the certificate asserts the CA/Browser Forum OV policy identifier 2.23.140.1.2.2.

Why it matters

OV lets relying parties see which legal entity controls a site by opening the certificate details, which some corporate, government and procurement policies require. Validated organization data can be reused for up to 398 days, while domain validation must be refreshed on the shorter schedule set by Ballot SC-081v3. Some commercial CAs let organizations automate OV issuance through ACME with External Account Binding once the organization has been pre-validated, so OV does not have to mean manual renewals.

Example

openssl x509 -in example.com.crt -noout -subject
# subject=C = US, ST = California, L = San Francisco, O = Example Inc., CN = example.com

The O field is what distinguishes this from a DV certificate, whose subject contains only the common name.

Common misconceptions

• OV certificates encrypt more strongly. The cryptography is identical to DV; only the identity checks differ.
• Browsers display the company name for OV. Mainstream browsers show the same address bar indicator for DV, OV and EV; the organization is visible only in the certificate viewer.
• OV prevents phishing. Users rarely inspect certificate details, and an OV certificate says nothing about a site's intent or content.