SSL Certificates: DV, OV, EV and Renewal
An SSL certificate lets browsers connect to your site over HTTPS and proves the connection is to your domain. Domain-validated (DV) certificates, including free ones, encrypt traffic exactly as well as paid organisation-validated (OV) or extended validation (EV) ones; the paid types add checks on the company behind the site. Maximum lifetimes are falling, so automatic renewal now matters more than the type.
Every site that collects a name, an email address or a payment needs HTTPS, and HTTPS needs an SSL certificate (strictly, a TLS certificate; the old name stuck). The choice used to be about which padlock looked most impressive. Today the encryption is identical across types, Chrome shows the same padlock for all of them, and the bigger question is how the certificate renews.
What an SSL certificate does
A certificate does two jobs:
- Encryption. It lets the browser and your server set up an encrypted connection, so forms, logins and payments cannot be read in transit.
- Identity. It is signed by a certificate authority (CA) that has checked you control the domain, and for some types, that the company behind it exists.
Without one, browsers mark your pages “Not secure”, and many forms and payment tools will not work.
A certificate does not make the website itself secure. It protects data travelling between the visitor and the server; it does nothing about an out-of-date plugin, a weak admin password or malware on the server. Treat it as one layer of protection alongside updates, backups and sensible access control, not as a badge that the whole site is safe.
DV, OV and EV compared
| Domain validated (DV) | Organisation validated (OV) | Extended validation (EV) | |
|---|---|---|---|
| What the CA checks | That you control the domain | Domain control plus the organisation’s legal existence and details | The strictest organisation checks, under fixed guidelines |
| Encryption | Same | Same | Same |
| What visitors see | Padlock | Padlock; company name in certificate details | Padlock; company name in certificate details |
| Cost | Often free | Paid | Paid |
| Issued in | Minutes, automatically | After the organisation checks | After the extended checks |
| Good for | Most websites, blogs and small business sites | Shops, portals and login pages where a verified company name helps | Banks, payment and large brands with a compliance need |
The EV green address bar is gone. The Chromium project’s note on the change explains that from Chrome 77 the EV details moved from the address bar into Page Info, opened by clicking the padlock. So pay for OV or EV when a partner, regulator or procurement process asks for a verified organisation, not to change what ordinary visitors see.
Free or paid
Free DV certificates are now the default for most websites. Let’s Encrypt, the best-known free CA, states in its FAQ that it does not charge for certificates, issues 90-day certificates by default, and has no plans to issue OV or EV certificates. Many hosts install and renew these automatically.
Most small business sites never need anything more. Pay for a certificate when you need:
- a verified organisation name (OV or EV)
- a warranty or a support contract from the CA
- a certificate for a system that cannot automate renewal
- a specific CA required by a partner or a payment provider
Wildcard and multi-domain certificates
- Single domain: covers one name, such as
www.example.com, and usually the bareexample.comtoo. - Wildcard: covers every first-level subdomain, such as
shop.example.comandblog.example.com, with one certificate. - Multi-domain (SAN): covers a list of different domains in one certificate, useful for a business with several brands on one server.
All three can be DV, OV or EV, with one exception: EV certificates cannot be wildcards. Choose the coverage first, then the validation level.
How renewal works
Every certificate has a maximum lifetime, and the industry is shortening it in steps. The CA/Browser Forum’s Baseline Requirements (section 6.3.2) set the maximum validity of public TLS certificates at:
| Certificate issued | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| 15 March 2026 to 14 March 2027 | 200 days |
| 15 March 2027 to 14 March 2029 | 100 days |
| From 15 March 2029 | 47 days |
The schedule came from ballot SC-081, which also shortens how long domain validation checks can be reused.
The practical effect: a paid certificate bought “for a year” is now usually delivered as a subscription with reissues during the year, and manual renewal by calendar reminder becomes impractical. Renewal should be automatic, using the ACME protocol that free CAs and many paid ones support. Let’s Encrypt recommends renewing its 90-day certificates every 60 days, so there is always a margin if a renewal fails.
What changes as lifetimes shrink
- Automate everything. Each server, load balancer and CDN that holds a certificate needs automatic renewal, or a person who will reliably reissue it.
- Know where your certificates are. Make a list: website, mail server, control panel, APIs, any device with a web interface.
- Monitor expiry. An uptime monitor that alerts you before a certificate expires catches a renewal that silently failed.
- Check OV and EV workflows. Organisation checks also have reuse limits, so plan for revalidation instead of discovering it on renewal day.
Common SSL problems and how to fix them
- “Not secure” on some pages only. Usually mixed content: an image, script or font still loads over HTTP. Update the links, or the setting in your CMS that stores the site address.
- Certificate name mismatch. The certificate covers
www.example.combut visitors arrive atexample.com, or the reverse. Reissue it to cover both names. - Incomplete chain. The server sends your certificate without the intermediate certificate from the CA. Some browsers cope, others and many apps do not. Install the full chain your CA provides.
- Expired after a host move. Automatic renewal was set up on the old server, not the new one. Check renewal straight after any migration.
- Email clients warn about the certificate. Mail servers need valid certificates for the name your mail apps connect to, such as
mail.example.com. Use the server name your host gives you, or add a certificate for your own mail name. - Redirect loop after switching to HTTPS. Often a CDN or proxy and the server both forcing HTTPS in conflicting ways. Set the CDN to connect to your server over HTTPS, then remove duplicate redirect rules.
Checklist: is your SSL set up properly?
- Every page loads over HTTPS, and HTTP redirects to HTTPS.
- Both
example.comandwww.example.comare covered. - No mixed content: images, scripts and fonts also load over HTTPS.
- Renewal is automatic, and you know which system does it.
- Someone is alerted before expiry.
- Mail and other subdomains have their own valid certificates.
- After moving host, the new server has a certificate before DNS is switched.
If you are changing host, our guide to moving a website without downtime covers when to issue the new certificate.
Getting SSL with Hostlyx
Every Hostlyx hosting plan includes a free SSL certificate that renews automatically. For organisation-validated, EV or wildcard certificates, we supply and install them, including on servers we do not host. Tell us your domains and where they are hosted, and we will send a fixed written quote.