Which SSL certificate do I actually need?

Domain Validation (DV)

The cheapest and fastest tier. The certificate authority checks that you control the domain — typically by asking you to publish a TXT record or click a link in an email — and issues the certificate in minutes.

When to choose DV: blogs, portfolios, marketing sites, most SaaS apps, internal tools. If your site doesn't take payments and isn't in a regulated industry, DV is almost certainly all you need.

What about LetsEncrypt? LetsEncrypt is free DV — and excellent. We install it on every hosting plan automatically. Paid DV mostly makes sense when you need a longer-lived certificate (one year vs LetsEncrypt's 90 days), a warranty, or a cert on a platform where ACME isn't supported.

Organization Validation (OV)

The CA also verifies that your business exists, is in good standing, and that you're authorized to request a certificate on its behalf. This takes 1–3 business days, and your organization's name appears in the certificate details.

When to choose OV: B2B SaaS where customers might inspect your cert, regulated industries (healthcare, fintech), businesses where being a verifiable entity matters. The trust signal is real if your buyer is technical.

Extended Validation (EV)

The most rigorous tier. The CA performs the same checks as OV plus a multi-step audit — phone verification, principal validation, on-the-ground confirmation. Modern browsers no longer show the green address bar (Chrome dropped it in 2019), but the validation level remains the gold standard.

When to choose EV: banks, payment processors, ecommerce platforms moving real money, government sites. If a phishing attack on your domain would be catastrophic, EV is worth the validation overhead.

Wildcard

Orthogonal to the three tiers above. A wildcard certificate covers *.example.com — every direct subdomain — under one cert. Available in DV and OV flavors.

When to choose Wildcard: any time you have three or more subdomains, or you're running multi-tenant SaaS with customer subdomains. One cert, every host, one renewal.

SAN (Subject Alternative Name)

A SAN certificate covers a specific list of hostnames — useful when you have a handful of unrelated domains and don't want a separate cert for each. Add up to 250 hostnames to one cert.