Every SSL/TLS certificate encrypts traffic the same way. What differs is how much the certificate authority checked before issuing it, and how many names it covers.
Validation levels
| Level | What is checked | Typical issue time | Fits |
|---|---|---|---|
| DV (domain validated) | Control of the domain only | Minutes | Blogs, company sites, most websites |
| OV (organisation validated) | The domain, plus that the organisation legally exists | Days | Business sites and portals that want the company name in the certificate |
| EV (extended validation) | Detailed checks of the organisation | Days to weeks | Organisations whose policies or tenders require it |
Browsers no longer show the company name in the address bar for EV certificates. Choose OV or EV for verification and policy reasons, not for a visual badge.
Coverage
| Type | Covers | Example |
|---|---|---|
| Single domain | One name (often with and without www) | example.com |
| Wildcard | All first-level subdomains of one domain | *.example.com covers shop.example.com, not a.b.example.com |
| Multi-domain (SAN/UCC) | A list of different names in one certificate | example.com, example.net, mail.example.org |
Validity
Since 15 March 2026, publicly trusted certificates can be valid for at most 200 days. Under the CA/Browser Forum's schedule this drops to 100 days in March 2027 and 47 days in March 2029. Automate renewal wherever possible, and keep track of any certificate that must be renewed by hand.
After installing
- Redirect HTTP to HTTPS.
- Install the full chain (intermediate certificates), not just your own certificate.
- Turn off TLS 1.0 and 1.1.
- Check the result with an SSL checker.