Certificate types: DV, OV, EV, wildcard and the rest
A certificate is not one thing. The same X.509 format is used for different purposes and under different trust models. This article separates the types and says which of them certificate lifecycle management is about.
19 August 2026 · 5 min read
By validation level
- DV (domain validated)
- The authority only verifies that you control the domain (a DNS record or an HTTP file). Issued within minutes, usually free and automated through ACME. The vast majority of websites use DV.
- OV (organisation validated)
- In addition to the domain, the organisation's existence is verified with documents; the organisation name appears in the certificate. A manual process taking a few days.
- EV (extended validation)
- Stricter organisation checks. Browsers used to show a green company name; that visual distinction has been removed. Shorter lifetimes make EV's manual process even more costly.
By scope
- Single domain
- One domain name; most authorities include the www prefix as well.
- Multi-domain (SAN)
- Several domain names in one certificate; common on load balancers and shared services.
- Wildcard
- *.company.com: every direct subdomain. Domain validation must be done through DNS (dns-01); HTTP validation is not allowed for wildcards.
By trust model
- Publicly trusted
- Issued by an authority in the browser root stores; subject to the CA/Browser Forum rules and the 47-day schedule.
- Internal PKI (private)
- The organisation's own root and intermediate authority; only the organisation's devices trust it. The lifetime rule is not mandatory, but the same discipline is good practice. If the internal PKI speaks ACME, it is managed with the same automation.
By purpose
- TLS server certificate
- Websites, APIs, load balancers, mail servers. The subject of this article and of Pecatra.
- TLS client certificate (mTLS)
- Proves the client's identity to the server; used between services and for VPN access.
- Code signing
- Verifies the origin of software packages; separate authority processes and a hardware key requirement.
- S/MIME and document signing
- E-mail and document signatures; certificates bound to a person.
- Device and IoT certificates
- Embedded in devices at manufacture, usually long-lived; a separate management topic.
Which ones lifecycle management is about
Shrinking lifetimes and the pressure to automate renewal concern publicly trusted TLS server certificates. Internal PKI certificates can be managed with the same tool; code signing and S/MIME are different processes.
- To be inventoried: public and internal TLS server certificates, together with every system they are installed on.
- Renewable automatically: certificates from an authority that speaks ACME; Let's Encrypt, commercial authorities with ACME support and internal PKIs that offer ACME.
- Still manual: OV and EV certificates and authorities without ACME; for these, at least monitoring and verified installation are automated.
Frequently asked questions
- Is a DV certificate enough for enterprise use?
- In terms of encryption and browser trust, yes. Organisations that want their name shown or have regulatory requirements choose OV.
- Wildcard or SAN?
- Wildcard is practical when subdomains change often; SAN is needed for different base domains. Both can be combined. Wildcard requires DNS validation.
- Does the 47-day rule apply to internal certificates too?
- It is not mandatory; the rule is for publicly trusted certificates. Since short lifetimes reduce the risk of a leaked private key, internal PKIs are moving the same way.
Sources
More articles
Manage your certificates in one place
Inventory, expiry tracking, renewal through ACME and verified installation, on your own infrastructure.