DV vs OV vs EV certificates: what each level validates

DV, OV and EV certificates differ only in how much the CA checks about you, not in encryption strength. DV proves control of the domain, OV adds a verified organization name, and EV adds a stricter, standardized legal-identity check. Browsers stopped showing EV company names in 2019, so DV with automated renewal is the right default for most websites.

The three levels at a glance

The validation level changes the checks the CA performs and the fields in the certificate subject, and nothing else. The table compares the levels as defined by the CA/Browser Forum Baseline Requirements (BR) and EV Guidelines.

There is also an IV (individual validated) level with OID 2.23.140.1.2.3, used when the subject is a named person rather than an organization. It is rare for websites.

Domain validation (DV): proving control of the name

A DV certificate says only that whoever requested it controlled the domain at the time of validation. The CA does not know or record who you are. The BR lists the allowed domain control validation (DCV) methods; the common ones are:

• DNS change: publish a random value in a TXT or CNAME record, which is what the ACME dns-01 challenge does.
• HTTP file: serve a random value at a URL under /.well-known/, which is what ACME http-01 does.
• TLS-ALPN: answer a special TLS handshake on port 443, the ACME tls-alpn-01 challenge.
• Email: click a link sent to a constructed address such as admin@ or webmaster@ the domain.

Since 2025 the BR also requires multi-perspective issuance corroboration (MPIC): the CA must see the same validation result from several network locations, which makes it much harder to fool a CA with a local BGP or DNS hijack.

DV is the only level that can be issued and renewed with no human involvement, which is why free ACME CAs such as Let's Encrypt issue only DV certificates. As lifetimes shrink, that matters more: under Ballot SC-081v3 the maximum certificate lifetime drops to 47 days on March 15, 2029, and the period for which a CA may reuse a domain validation drops to 10 days. See 47-day certificates.

Organization validation (OV): a verified company name

An OV certificate adds the organization's verified legal name and location to the certificate subject. Before issuing, the CA confirms that the organization exists, usually through a government business registry or another reliable data source; confirms its address; and verifies that the person ordering the certificate is authorized to do so, typically with a call to a phone number the CA found independently.

You can see the difference directly in the subject field:

DV:  subject=CN=example.com
OV:  subject=C=US, ST=California, L=San Francisco, O=Example Inc., CN=example.com

OV validation data can be reused for later orders, so renewing an OV certificate is usually fast once the organization is on file. SC-081v3 shortens that reuse period for organization data from 825 days to 398 days, so expect to re-confirm your organization roughly once a year.

Extended validation (EV): the strictest identity check

EV certificates follow a separate CA/Browser Forum document, the EV Guidelines, first adopted in 2007 with a fixed, auditable vetting procedure. On top of OV-style checks, the CA must verify:

• the organization's legal existence and registration number with the registering agency in its jurisdiction;
• a physical place of business;
• operational existence, which for organizations younger than about three years usually means confirming an active bank account;
• that the people who request and approve the certificate are authorized by the organization, including a signed subscriber agreement.

The certificate subject carries extra fields such as businessCategory, serialNumber (the registration number) and jurisdictionCountryName. EV certificates cannot contain wildcard names.

Why browsers stopped showing EV

EV was designed for a browser UI that no longer exists. For about a decade, browsers showed the verified company name in a green bar next to the URL. Chrome's security UX team concluded that the indicator did not change user behavior: people did not avoid entering passwords or card numbers when it was missing. Chrome 77 moved EV information into the Page Info panel in 2019, and Firefox 70 made the same change the same year.

Researchers also showed that the company name could mislead. In 2017 a researcher registered a company with the same name as a well-known payments firm in a different US state and obtained a valid EV certificate showing that name, which was entirely within the rules.

The secure-connection indicator itself has since become neutral. Chrome 117, released in September 2023, replaced the padlock with a "tune" icon because many users read the padlock as "this site is trustworthy" rather than "this connection is encrypted".

Encryption is identical at every level

The validation level has no effect on the cryptography. The certificate's key (RSA or ECDSA), the TLS version, the cipher suite and forward secrecy are all chosen independently of DV, OV or EV. A free DV certificate and an expensive EV certificate on the same server negotiate exactly the same TLS 1.3 connection.

The same rules apply to everything else too. All publicly trusted TLS certificates must be logged in Certificate Transparency, all are subject to CAA checks, and all share the same maximum lifetime.

How to tell which level a certificate is

The policy OID in the Certificate Policies extension is the reliable answer; the presence of an O= field is a strong hint. With OpenSSL:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -ext certificatePolicies

subject=CN=letsencrypt.org
X509v3 Certificate Policies:
    Policy: 2.23.140.1.2.1

That output, taken from letsencrypt.org in November 2026, shows a DV certificate: no organization in the subject and the DV policy OID. In Chrome you can find the same information by clicking the icon to the left of the address, then "Connection is secure", then "Certificate is valid", and opening the Details tab. The certificate decoder shows the level for any pasted certificate.

Which one should you choose

Choose by who needs the identity information, not by how secure you want the site to be.

• Websites, APIs and SaaS products: DV. Use an ACME client and automate renewal. Shorter lifetimes make automation the main operational requirement, and DV is the only level that is fully automatic. See automating certificate renewal.
• When a contract, auditor or procurement rule asks for an identified organization: OV. Some enterprise, government and financial projects require the organization name to appear in the certificate. Make sure the CA offers ACME with pre-validated organizations, so renewals can still be automated.
• EV: only when a policy specifically requires it. EV no longer gives users a visible signal in mainstream browsers. If you keep it, budget for re-validation. EV wildcards are not available.

Two related products use similar identity checks but are not TLS server certificates: code signing certificates, where an EV-style check affects how Windows treats signed software, and Verified Mark Certificates for BIMI email logos. Do not let their requirements drive your choice for a website.

What shorter lifetimes change for OV and EV

Shrinking lifetimes hit OV and EV harder than DV, because their manual steps repeat with every renewal. Under Ballot SC-081v3 the maximum lifetime falls from 200 days today to 100 days on March 15, 2027 and 47 days on March 15, 2029. At 47 days a certificate has to be replaced roughly eight times a year.

Three parts of the workflow are affected differently:

The practical consequence is that a paid OV or EV certificate is only manageable at scale if the CA lets you bind an ACME client to a pre-validated organization account, usually through ACME External Account Binding (EAB). If renewal still means uploading a CSR into a web portal and waiting for an approval email, plan to move away from that process before 2027.

Common misconceptions

The usual arguments for OV and EV (phishing protection, stronger encryption, warranties for visitors) do not hold up.

• "EV prevents phishing." Phishing sites use DV certificates for their own domains. EV only describes who owns the domain that is shown, and users rarely look.
• "OV/EV gives stronger encryption." Encryption is identical; see above.
• "Paid certificates come with warranties that protect visitors." CA warranties cover narrow cases of CA mis-issuance under conditions set by the CA. They are not insurance for your users, so read the terms before treating them as a reason to buy.
• "DV is only for small sites." Many of the largest sites on the web use DV certificates because they need automation at scale.

If you are comparing paid certificates anyway, the price difference between levels pays for the CA's manual vetting work, not for any technical capability of the certificate.