Quick answer: Most websites need a Domain Validated (DV) SSL/TLS certificate that enables HTTPS and shows the browser padlock. Organization Validated (OV) and Extended Validation (EV) add identity checks on the company behind the domain. Wildcards cover many subdomains; multi-domain (SAN) certs cover several hostnames. Pick DV for standard sites unless a partner or compliance process asks for OV/EV.
HTTPS first, certificate marketing second
Encrypting traffic between browsers and your server is the baseline. Search engines have treated HTTPS as a ranking signal for years, and browsers label HTTP as not secure. If you are still on HTTP, migration matters more than EV cosmetics. Follow a careful HTTPS migration so redirects and Search Console stay healthy.
Certificate “type” answers how thoroughly the certificate authority (CA) validated you, and which names the cert covers. It does not replace secure coding, patching or good hosting.
Domain Validated (DV)
What it is. The CA checks that you control the domain (DNS record, email to an admin address or file upload). Issuance is fast, often automated.
Who it fits. Blogs, brochure sites, most marketing sites, many ecommerce stores, SaaS apps, APIs.
What users see. Padlock / secure connection in modern browsers. (Browser UI for EV has been changing over recent years; do not buy EV only for a green address bar you saw in an old screenshot.)
Let’s Encrypt and many host-bundled certs are DV. They are real SSL/TLS certificates. “Free” does not mean “fake” when the CA is trusted.
Organization Validated (OV)
What it is. DV checks plus verification that a legal organization exists and matches details in the certificate subject.
Who it fits. Companies that want organizational identity in the certificate itself, or that face vendor questionnaires asking for OV.
Trade-offs. Slower issuance; more paperwork. Not a magic trust badge for users who never inspect certificate details.
Extended Validation (EV)
What it is. A stricter organizational validation process under EV guidelines.
Who it fits. Some finance, fintech and enterprise contexts where EV is expected by policy or tradition.
Trade-offs. Higher cost and longer setup. Browser presentation of EV has been less distinctive than it once was, so the user-visible benefit is smaller than older marketing claimed. Buy EV for policy fit, not for nostalgia about green bars.
Wildcard certificates
What it is. A cert for *.example.com covering arbitrary one-level subdomains.
Who it fits. Teams with many subdomains (app, staging, regional hosts) that want one cert to manage.
Caveats. Wildcards usually do not cover the apex example.com unless also included. They do not cover multiple levels like a.b.example.com unless you plan specifically. Protect private keys carefully; a wildcard key is powerful if leaked.
Multi-domain / SAN certificates
Subject Alternative Name (SAN) certs list multiple distinct hostnames (www.example.com, example.com, otherbrand.com). Handy when several names terminate on one load balancer.
Inventory hostnames before purchase so you do not redeploy weekly.
What about code signing and email certs?
Those are different products. This article focuses on TLS certificates for websites. Do not assume a site cert covers email signing or software signing.
Hosting, CDNs and managed certs
Many hosts and CDNs issue and renew DV certificates automatically. That is often the best path for small business sites: less manual renewal risk. Confirm:
- Auto-renewal is on
- Both apex and www are covered if both serve traffic
- Staging domains use separate certs or names
- Your origin still speaks TLS correctly when a CDN terminates TLS at the edge
WordPress hosting and other managed hosts often include TLS. Ask explicitly; do not assume.
Mixed content and configuration
A valid certificate does not fix HTTP images on HTTPS pages. Browsers will warn or block. After installing a cert:
- Redirect HTTP to HTTPS
- Update site URLs and asset references
- Check APIs and webhooks for HTTPS endpoints
- Enable HSTS only after you are sure HTTPS works everywhere you need
Old SSL protocol issues (such as ancient SSLv3 weaknesses) are a reminder to keep TLS versions and cipher settings current on the server, not only to buy a new file from a CA.
Security beyond the padlock
Certificates authenticate the server name and encrypt the pipe. They do not stop malware in WordPress, weak passwords or vulnerable plugins. Pair HTTPS with the hygiene in our WordPress security guide and web application firewall layers when appropriate. Domain security habits (registrar locks, DNS access control) also protect the validation channels CAs rely on.
Ecommerce teams should keep card data in the payment gateway’s scope. TLS is required; it is not the whole of PCI responsibility. See PCI compliance for broader context.
Choosing quickly
- Need HTTPS on a normal site? Start with DV (often free via host or Let’s Encrypt).
- Many subdomains on one property? Consider wildcard or automation that issues per-host DV certs.
- Several unrelated hostnames on one server? SAN / multi-domain.
- Partner or compliance insists on OV/EV? Buy that, and still run modern TLS settings.
- Still on HTTP? Migrate before debating EV.
Renewal and operations
- Calendar reminders if renewal is manual
- Prefer automated issuance
- Document where private keys live
- After renewals, confirm mobile clients and old boxes still trust the chain
- Monitor expiry; expired certs are a very public outage
Private keys and CSR hygiene
Generate private keys on secure systems, use adequate key sizes per current CA baseline requirements, and never email private keys. If a key may have leaked, reissue. When using ACME automation (common with Let’s Encrypt), protect the machine that holds the ACME account and DNS API credentials as carefully as you protect the key itself.
For multi-server setups, prefer automation or a secrets vault over copying .pem files through chat apps. Load balancers and Kubernetes-style ingress (where you use them) should be part of the certificate plan so renewals propagate everywhere traffic terminates.
Internal links and certificates on staging
Staging sites need HTTPS too if you test mixed content and cookies with the Secure flag. Use separate hostnames and certificates rather than sharing production private keys broadly across laptops. Short-lived staging certs via automation keep friction low.
FAQ
Is a paid DV cert better than Let’s Encrypt?
Not cryptographically in any way that matters for typical sites. Paid DV may include support warranties or warranty marketing. Automation and uptime matter more than the price tag.
Do I need EV for ecommerce?
Usually no. Customers care about familiar checkout, clear policies and the padlock. Some enterprises still ask for EV in questionnaires; answer those case by case.
Can I use one cert for email and web?
Sometimes names overlap, but mail servers and web servers often need separate planning. Configure each service properly rather than forcing one file everywhere without care.
What is the difference between SSL and TLS?
SSL is the old name; modern certificates use TLS protocols. People still say “SSL certificate” out of habit. Buy current TLS-capable certificates from trusted CAs.
Buy the validation you need, then operate it well
SSL certificate types mostly answer validation depth and name coverage. For most business websites, DV plus solid HTTPS configuration is enough. Add OV/EV when a real requirement demands them, and use wildcards or SAN when your hostname inventory says so. If you need help hardening hosting and CMS setups, see our Turn visitors into customers services.
