Search... ⌘ K
Get Started Contact Sales

SSL Certificate Types

Last updated

Table of Contents

SSL certificates can be classified in two ways: by validation level (how the certificate authority verifies the certificate holder’s identity) or by secured domains/hostnames (how many hostnames the certificate protects). Understanding these classifications helps you choose the right certificate type for your needs.

SSL Certificates by Validation Level

The validation level determines the method adopted by the Certificate Authority to confirm the identity of the certificate applicant.

Domain Validated SSL Certificates

The Domain Validated SSL Certificate validates the domain is registered and someone with admin rights is aware of and approves the certificate request.

The validation process is normally performed via email or DNS. The owner is requested to prove admin right by receiving and confirming an email sent to an administrative email for the domain, or by configuring some specific DNS records for the domain. For a detailed comparison of validation methods, see Domain Validation Methods for SSL Certificates.

It is the fastest type to issue, because there is no organization to check.

If the certificate is valid and signed by a trusted authority, the browser shows the connection as secure.

Note

DNSimple provides domain-validated SSL certificates only: single-name and wildcard SSL certificates from Sectigo, and single-name, same-domain SAN, and wildcard certificates from Let’s Encrypt. To order one, see How to Buy a Sectigo SSL Certificate or How to Get a Free Let’s Encrypt SSL Certificate.

Organization Validated SSL Certificates

The Organization Validated SSL Certificate (OV certificate) validates the domain ownership, plus organization information included in the certificate such as name, city, state and country.

The validation process is similar to the domain validated certificate, but it requires additional documentation to certify the company identity.

Issuance takes longer than for a domain-validated certificate, because of the company validation process.

The Organization Validated SSL Certificates display the company information in the certificate details.

Note

DNSimple does not provide organization-validated certificates.

Extended Validation SSL Certificates

The Extended Validation SSL Certificate (EV certificate) requires an extended validation of the business. It validates domain ownership and organization information, plus the legal existence of the organization. It also validates that the organization is aware of the SSL certificate request and approves it.

The validation requires documentation to certify the company’s identity, plus a set of additional steps and checks.

It is usually the slowest type to issue, because of the extended validation process.

Browsers used to show EV certificates with a green address bar containing the company name. Chrome, Firefox, and Safari removed that indicator in 2019, so an EV certificate now looks the same as any other certificate in the address bar. The company name only appears in the certificate details.

Note

DNSimple does not provide extended validation certificates. See why DNSimple does not offer EV certificates.

SSL Certificates by Secured Domains

An SSL certificate is associated to one or more secured host names that restrict the scope of a certificate.

Single-name SSL Certificates

Single-name SSL certificates protect a single subdomain (hostname). The hostname is the certificate’s common name.

For example, if you purchase a certificate for www.example.com it will not secure mail.example.com.

Some certificate authorities also include the root domain when the hostname is www. At DNSimple, a Sectigo certificate for www.example.com also covers example.com.

Note

DNSimple provides single-name certificates from Sectigo and Let’s Encrypt.

Wildcard SSL Certificates

Wildcard SSL certificates protect an unlimited number of subdomains for a single domain.

For example, if you purchase a certificate for *.example.com it will secure foo.example.com, bar.example.com, etc. However, it will not secure foo.else.example.com.

Note

DNSimple provides wildcard SSL certificates from Sectigo and Let’s Encrypt. See How to Buy a Wildcard SSL Certificate.

Multi-Domain SSL Certificates

Multi-domain SSL certificates protect different domains with a single certificate, using the Subject Alternative Name (SAN) extension. For this reason, these certificates are often referred to as SAN certificates.

You can generally secure a combination of different host names, from the same or different domains.

Note

DNSimple provides SAN certificates from Let’s Encrypt, but all the names must belong to the same domain. Certificates that cover several different domains are not supported. For how Sectigo and Let’s Encrypt compare, see Sectigo vs Let’s Encrypt SSL Certificates.

Security

The validation level and the number of secured domains do not affect the encryption strength of an SSL certificate. A domain-validated (DV) certificate provides the same encryption as an extended validation (EV) certificate. The validation level determines what information appears in the certificate and how the CA verified the applicant’s identity, but it does not change the cryptographic strength. Similarly, protecting multiple hostnames with a single certificate does not reduce security.

Have more questions?

If you have additional questions or need any assistance with certificate types and which one to choose, just contact support, and we’ll be happy to help. You can also read more about DNSimple Enterprise.