# What Is OV Certificate? Definition and Examples

> OV certificates are TLS certificates whose CA has verified both control of the domain and the legal existence of the organization named in them.

Source: https://ssl.sh/glossary/ov-certificate/
Last updated: 2026-11-10

An OV (Organization Validated) certificate is a TLS certificate whose subject identifies a verified organization in addition to the domain. Besides the [domain control validation](https://ssl.sh/glossary/dcv/) required for every publicly trusted certificate, the CA checks that the organization legally exists, typically against government business registries or other reliable sources, and confirms that the applicant is authorized to request the certificate. The subject then carries fields such as organization (O), locality (L), state (ST) and country (C), and the certificate asserts the CA/Browser Forum OV policy identifier 2.23.140.1.2.2.

## Why it matters
OV lets relying parties see which legal entity controls a site by opening the certificate details, which some corporate, government and procurement policies require. Validated organization data can be reused for up to 398 days, while domain validation must be refreshed on the shorter schedule set by Ballot SC-081v3. Some commercial CAs let organizations automate OV issuance through [ACME](https://ssl.sh/glossary/acme/) with [External Account Binding](https://ssl.sh/glossary/eab/) once the organization has been pre-validated, so OV does not have to mean manual renewals.

## Example
```bash
openssl x509 -in example.com.crt -noout -subject
# subject=C = US, ST = California, L = San Francisco, O = Example Inc., CN = example.com
```

The O field is what distinguishes this from a [DV certificate](https://ssl.sh/glossary/dv-certificate/), whose subject contains only the common name.

## Common misconceptions
- **OV certificates encrypt more strongly.** The cryptography is identical to DV; only the identity checks differ.
- **Browsers display the company name for OV.** Mainstream browsers show the same address bar indicator for DV, OV and EV; the organization is visible only in the certificate viewer.
- **OV prevents phishing.** Users rarely inspect certificate details, and an OV certificate says nothing about a site's intent or content.

## Related terms

- [DV 证书](https://ssl.sh/zh/glossary/dv-certificate/): DV 证书是 CA 只验证申请者对域名的控制权、不核实申请者身份的 TLS 证书，签发快且可以完全自动化。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [DN](https://ssl.sh/zh/glossary/distinguished-name/): DN 即可分辨名称，是由 C、O、CN 等属性组成的 X.500 风格结构化名称，用来标识 X.509 证书的主体和颁发者。
- [SSL 证书](https://ssl.sh/zh/glossary/ssl-certificate/): SSL 证书是由 CA 签名的 X.509 证书，把公钥与一个或多个域名（或 IP 地址）绑定，供 TLS 客户端验证服务器身份。
- [证书策略](https://ssl.sh/zh/glossary/certificate-policy/): 证书策略（CP）是针对某类证书签发和使用制定的一套命名规则，在证书的证书策略扩展中以 OID 形式引用。
- [EAB](https://ssl.sh/zh/glossary/eab/): EAB 即外部账户绑定，是 ACME 的一项功能，用 CA 提供的密钥 ID 和 HMAC 密钥把新 ACME 账户关联到你在该 CA 的已有客户账户。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。