SSL certificate types: DV vs OV vs EV, wildcard and multi-domain

The short version

• Almost every website needs only a Domain Validated (DV) certificate. It is the type that Let’s Encrypt, Cloudflare and most hosts and builders give away free.
• OV and EV certificates put your checked company name inside the certificate. Chrome moved that name out of the address bar starting with Chrome 77, so most visitors never see it.
• Coverage is a separate choice: single domain (one name), wildcard (every subdomain one level down) or multi-domain, also called SAN (a list of names).
• Paying more does not buy a longer certificate. Public certificates issued from March 15, 2026 last at most 200 days, falling to 47 days in 2029, so automatic renewal matters more than the type.

Two choices, not one

An SSL certificate is the file that lets your site load over HTTPS. It is issued by a certificate authority (CA), a company browsers trust to check who is asking for one. You can read the background in our HTTPS and TLS entry.

When you shop for one, you make two separate choices:

1. Validation level: how much the CA checks about you (DV, OV or EV).
2. Coverage: how many names the certificate protects (single, wildcard or multi-domain).

The two mix. Namecheap, for example, sells a DV wildcard, an OV wildcard and an EV multi-domain certificate. One combination the rules forbid: an EV wildcard.

DV vs OV vs EV: what the CA checks

The industry rulebook, the CA/Browser Forum Baseline Requirements, says every type gives the same assurance about the domain name. The types differ only in how much information about the owner is checked and included. (The rules also list a fourth type, Individual Validated, or IV.)

Namecheap now sells SSL.com certificates; the prices above are its Standard SSL, High Assurance SSL and EV SSL. Some are sale prices: Standard SSL is $11.00 against a regular $13.20, and EV SSL is $76.99 against a regular $92.39. Renewal prices and other sellers are on our free vs paid SSL page.

How a domain check works

Every certificate, at every level, starts with a domain check. The CA gives you a random code and confirms it shows up where only the domain’s owner could put it. Common ways:

• A record in your DNS settings (the address book for your domain).
• A file on your website, which Let’s Encrypt checks over port 80, the normal web port.
• An email to admin@, administrator@, webmaster@, hostmaster@ or postmaster@ your domain. The rules bar CAs from relying on this email method from March 15, 2028.

Hosts and builders that include free SSL do this check for you. Before issuing, the CA must also read your CAA records, an optional DNS setting that lists which CAs may issue for your domain. If you have none, any CA may issue.

How long the checks stay good

Your company checks for OV and EV can be reused for up to 398 days, so you do not redo the paperwork each time the certificate is replaced. Domain checks are reused for far less: 200 days now, 100 days from March 15, 2027, and 10 days from March 15, 2029. That is why the domain check has to be automatic.

Single vs wildcard vs multi-domain (SAN)

Every certificate lists the names it covers in a field called the subjectAltName, or SAN. The CA must check each name on the list. A subdomain is a name in front of your domain, such as shop.example.com.

Namecheap’s 1-year prices again; its multi-domain regular prices are $43.19 (DV), $95.99 (OV) and $196.79 (EV). Its pages do not list a price for each extra domain.

A few rules to know about wildcards:

• A wildcard matches exactly one level. DigiCert gives the example that it would not secure enterprise.sales.yourdomain.com.
• EV certificates cannot be wildcards.
• Free wildcards from Let’s Encrypt need the DNS check, so you or your host must be able to add DNS records.
• CAs must refuse wildcards over shared endings such as *.com or *.co.uk.

You may not need to buy a wildcard at all. Cloudflare’s free Universal SSL covers your root domain and first-level subdomains on a full setup. Kinsta includes free wildcard support on all plans, SiteGround gives wildcards when your domain uses its DNS, and Cloudways offers one-click Let’s Encrypt wildcards. DreamHost’s free certificates do not support wildcards, and WP Engine gives free single-domain certificates only. See SSL by platform for the full list.

What visitors see now

For most visitors, a DV, OV and EV certificate look the same.

• Chrome: Google announced in 2019 that from Chrome 77 the EV company name would leave the address bar and move into Page Info, which you open by clicking the icon. Its security team concluded that “the EV UI does not protect users as intended.” In 2023 Google also announced that Chrome 117 would replace the padlock with a “tune” icon, a symbol usually used for settings. More in our Google Chrome entry.
• Firefox: shows a padlock with no red strike on an encrypted connection. For EV sites, its connection panel still shows the owner’s legal name and location.
• No certificate at all: Chrome marks the site “Not secure,” meaning others may be able to see or change what is sent. Starting with Chrome 154, Chrome asks before opening a public site over plain HTTP. Safari also shows “Not Secure” for sites on HTTP and for expired certificates.

The takeaway: the missing certificate is what visitors notice. The type is almost invisible.

How to choose in five steps

1. Check what you already have. Most builders and hosts install a free DV certificate and renew it for you. If your site already loads on https:// with no warning, you may be done.
2. Count your names. One site: the free certificate your host or builder sets up is made for this. Many subdomains: a wildcard, often free from your host or Cloudflare. Several separate domains: a multi-domain certificate, or a free certificate for each.
3. Decide if anyone needs your company name inside the certificate. If a partner, bank or your own policy requires it, buy OV, or EV for the strictest checks. If no one asks, DV is enough.
4. Plan the renewal. With lifetimes falling from 200 days now to 100 days in March 2027 and 47 days in March 2029, pick a setup that renews on its own. A multi-year paid plan is a subscription: Namecheap’s product pages say the certificate should be reissued, free, every 200 days.
5. Check your CAA records if you have them. If they do not list the CA your host or builder uses, the certificate will not issue. WordPress.com and GoDaddy’s website builder both name CAA records as a cause of failed SSL. Fixes are in fix SSL errors.

Back to the SSL certificates hub for the big picture.

Sources: CA/Browser Forum: Baseline Requirements, EV Guidelines. IETF: RFC 9525 (wildcard matching), RFC 8659 (CAA). Google: Chrome identity indicators (2019), lock icon update, Chrome Help on secure connections, Chrome 154 release notes, HTTPS by default (2025). Mozilla: Firefox connection security. Apple: Safari Not Secure warnings. Let’s Encrypt: FAQ, challenge types. DigiCert: wildcard FAQ. Cloudflare: Universal SSL. Namecheap: SSL certificates, Standard SSL, High Assurance SSL, EV SSL, Standard Wildcard, OV Wildcard, SAN Certificate, OV Multi-Domain, EV Multi-Domain. Hosts: Kinsta, SiteGround, Cloudways, DreamHost, WP Engine, WordPress.com, GoDaddy.