DV, OV, and EV certificates

A DV certificate proves that you control the domain name on the certificate. OV and EV certificates add organization checks on top of that name control. Browsers no longer show a green bar for EV, and the padlock looks the same for all three. AutoSSL on our cPanel plans issues free Let’s Encrypt DV certificates, and those encrypt TLS the same way a paid OV does.

The padlock only means the connection is encrypted and the name matches. It does not encrypt DNS, and it does not make your application safer by itself. Phones often fail first when an intermediate certificate is missing from the chain, so a complete chain still matters no matter which class you buy.

What DV, OV, and EV actually prove

A DV certificate means you passed an HTTP-01 or DNS-01 challenge for the hostname. An OV certificate means a certificate authority also reviewed organization records. An EV certificate means a longer version of that review, usually with higher cost and slower issuance. Users will not see a company name in a green address bar anymore. They will see a padlock or a warning.

A paid DV from a storefront is still DV. You are paying for support and a warranty, not a different padlock. AutoSSL is DV, automated, and enough for almost every site we host. Wildcard DV needs DNS-01 validation instead of the usual HTTP check. EV will not fix a mixed-content page that still loads assets over plain HTTP.

What a paid cert will not fix

Buying EV will not boost SEO. Search engines have said for years that certificate class is not a ranking signal. Fix slow response times and clear page titles instead. If a partner still asks for OV or EV on a checklist, that is a compliance request, not a browser trust upgrade. Encrypt the name, match the name in the address bar, and ship a complete chain.

Choose and install the certificate you need

For almost every site, leave AutoSSL on and let it issue DV. If a partner checklist requires OV or EV, buy that certificate, install it under SSL/TLS in cPanel, and disable AutoSSL for that hostname so the two processes do not overwrite each other. Do not stack several certificates on one virtual host just in case.

1. Decide whether you only need HTTPS or a partner checklist that names OV or EV.
2. If you only need HTTPS, leave AutoSSL enabled and confirm the certificate name matches the address bar.
3. If you need OV or EV, purchase it, install it in SSL/TLS, and turn AutoSSL off for that name.
4. Test on a phone as well as a desktop, because broken chains often show up on phones first.

Read the leaf certificate on the server

Saying you bought EV is not the same as proving what the server presents. Ask the server directly and save the output:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subject

Check the subject, issuer, and dates. A padlock screenshot is not an issuer line. If AutoSSL is still enabled for the same name, tell us on the ticket so we do not reissue the wrong class over a paid certificate. See Why AutoSSL fails when the automated DV process is the one showing red.