Different validation methods
When researching SSL certificates, you'll notice a few differences in the type of validation they offer. For example:
- DV (Domain validation)
- OV (Organization validation)
- EV (Extended validation)
There is no difference in the encryption protection these certificates offer, however, there is a difference in the validation required to issue them to your site.
The validation method describes how the certificate is verified by the issuing Certificate Authority. This ensures that the site it's being issued to is correct and authorized to use it.
Domain validation
These include both the Let's Encrypt certificate and the Sectigo DV certificate offered by DreamHost.
These types of certificates are validated using only the domain name. As such, the name of your website is not included in the certificate itself when viewing it. Anyone with admin rights to the website's panel can add either certificate. After adding in the panel, the certificate is added automatically.
These certificates should only be used by smaller sites that do not exchange sensitive information. This would include:
- blogs
- forums
- personal sites
Although they offer the same level of encryption as OV certs, these certificates do not display the actual site name within the certificate, meaning visitors are not able to validate the certificate by viewing it. Additionally, these are potentially vulnerable to phishing attacks. For example, a malicious user could create a similar site with a DV certificate to create a forged copy of your online store. For these reasons, these are not recommended for eCommerce sites that process payment information.
Organizational validation
These validate everything a (DV) does, while also validating additional organizational information about who is purchasing the certificate such as their Name, City, State, Country. The organization's name is also included in the certificate. This adds an additional layer of trust to visitors in that they can ensure the website and company are reputable.
(OV) certificates may require the user to respond to an email with a verification code. However, this depends on how the DCV process verifies the certificate. View the following article for all steps required:
These certificates can be used on eCommerce sites to process payments.
Extended validation certificates
EV certificates ensure the highest amount of trust to visitors as they require the most information to be validated in order to be issued to the site.
They can be noted by the green URL bar displayed in the browser when visiting the site. This is a quick visual confirmation to the user that the site they are visiting has taken the maximum steps to ensure to confirm to users the site they're visiting. An example of a site with this type of certificate is bestbuy.com:
DreamHost does not currently offer these types of certificates.
What type of certificate should I use for my eCommerce site?
You can use either a 'Let's Encrypt' or professionally-signed 'Sectigo' certificate for your eCommerce website. Both use an RSA 4096 bit key to encrypt the connection, so the security is the same for both options.
The only difference is that a paid 'Sectigo' certificate includes the organization's name in the certificate information. This additional validation can appear more trusting to customers, which is why this type is recommended for eCommerce sites.
