SSL Certificates Explained: DV, OV, EV and Wildcards

What SSL actually does

TLS (still commonly called SSL) encrypts the connection between browser and server so credentials, form data and payment details cannot be read in transit. It also confirms that the server you reached genuinely controls the domain name in the address bar.

HTTPS is not optional any more. Browsers mark plain HTTP as not secure, search engines prefer secure pages, and modern features such as service workers and HTTP/2 require it.

Validation levels

  • DV (Domain Validation) — proves control of the domain, issued in minutes, free via Let's Encrypt/AutoSSL. Correct choice for the vast majority of websites, including small stores.
  • OV (Organisation Validation) — the certificate authority verifies your registered company. Useful where partners or procurement teams inspect certificate details.
  • EV (Extended Validation) — the deepest vetting. Browsers no longer display a distinct green bar, so its practical benefit is limited to compliance requirements.
  • Wildcard — covers unlimited first-level subdomains (*.yourdomain.com), ideal when you spin up many subdomains.
  • Multi-domain (SAN) — one certificate covering several distinct domains.

Encryption strength is identical across all levels. You are buying identity assurance, not stronger security.

Install and enforce

  • 1 In cPanel open SSL/TLS Status and run AutoSSL for every domain and subdomain.
  • 2 Confirm the certificate covers both yourdomain.com and www.yourdomain.com.
  • 3 Enable Force HTTPS Redirect in the Domains section.
  • 4 Update your application's site URL to the https:// version.
  • 5 Fix mixed content — any image, script or stylesheet still loaded over http:// will break the padlock.
  • 6 Once everything is stable, add an HSTS header so browsers refuse to downgrade.
# .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Common certificate errors

  • NET::ERR_CERT_COMMON_NAME_INVALID — the hostname is not on the certificate; re-run AutoSSL including that hostname.
  • Certificate expired — renewal failed, usually because a DNS validation record or HTTP challenge path was blocked.
  • Mixed content warnings — hard-coded http:// URLs in the database or theme.
  • Untrusted issuer — a self-signed certificate is in use; replace it with an AutoSSL or commercial certificate.

Frequently asked questions

Is free SSL as safe as paid SSL?

The encryption is identical. Paid certificates add organisational identity vetting, longer terms and warranties — not stronger cryptography.

Do I need SSL if I do not take payments?

Yes. Browsers warn on any HTTP page with a form, and search visibility and user trust both suffer without it.

Need a hand applying this?

Our engineers can do it for you. Open a ticket and we will help.

See plansTalk to us