Types of SSL Certificates

Before we go any further, it’s time to reveal something about SSL certificates that might just blow your mind: all SSL certificates have the same level of encryption – it’s the level of validation that sets them apart.

Validation level refers to the extent of checks that a Certificate Authority does to verify the identity of a person or organization that owns a website. But what exactly is a certificate authority (CA) and what gives them the authority to do this?

A CA is a third-party organization that is trusted by the CA membership programs of different electronic devices, operating systems, and browsers. A CA must adhere to the criteria of each membership program to become a trusted authority. Commonly used CAs include Comodo (now Sectigo, which signs the SSL certificates offered by Namecheap), GlobalSign, and DigiCert.

The extent of checks a CA runs to verify you or your organization is dependent on the kind of website you have and the level of validation it requires.

The type of validation you decide to go for will be dependent on the size and scope of your website, as well as the kind of data you will be requesting from your users and/or customers. The three main types of SSL validation are:

• Domain validated certificates (DV SSL)

• Organization validated certificates (OV SSL)

• Extended validated certificates (EV SSL)

Let’s take a look at how each type is validated, how you can recognize it in your web browser, and each of their pros and cons.

• How it’s validated: DV SSL certificates have the lowest level of validation of the three. When issuing DV certs, CAs do not look into information about the identity of a person or company running a website. They simply verify that they have control over the domain that they are looking to get SSL certified.

• What it looks like: The web address will feature “https” and the padlock symbol. When you click on the padlock or a tune icon to view the certificate, the information about website ownership will be limited.

• Pros: DV SSL certs are issued more quickly than the other options due to the less rigorous verification process, which is generally online and automated. Most of the time it is issued on the same day, often in a few minutes. It is the cheapest option of the three, with some CAs offering them for free. This makes it ideal for smaller websites and blogs.

• Cons: As we mentioned before, while the encryption level of a DV SSL is just as effective as the other two, the low level of validation means that website users don’t have much of an idea of who a domain owner actually is. This can impact your site’s trustworthiness and makes it a less than ideal option if you’re running an online store or any kind of site that requires users hand over sensitive information.

• How it’s validated: The background checks and verification process are more intensive for OV SSL certificates. CAs verify the individual or business that own the domain and do some minor vetting.

• What it looks like: In the browser address bar, an OV SSL cert is signified in much the same way as DV SSL – with the “https” prefix in the address bar. However, when you click on the tune icon or the padlock it will display more information about that company that owns the domain, such as name, address, and country.

• Pros: OV SSL certificates are considered more trustworthy than DV SSL since users will know who is behind the website and who they are giving information to. This makes it an ideal option for e-commerce sites.

• Cons: OV certs take longer to issue than DV certs. Verification can take several days. However, it’s more than likely worth it for your customers’ peace of mind.

• How it’s validated: The highest level of SSL certification you can get, when issuing EV certs, CAs do extensive background checks on the domain owning organization, validating its ownership, legal existence, physical location, and more.

• What it looks like: Similar to other validation types, EV certificates are displayed with the “https” prefix in the address bar and a padlock or a tune icon.

• Pros: EV certificates undergo a rigorous validation process, which includes extensive vetting of the organization's identity, providing the highest level of trust and security for website users.

• Cons: An EV SSL cert is more expensive compared to the other options. The extent of the checks means verification can take a week or even more.

Another way to secure your site that isn’t recommended is through a self-signed certificate. A self-signed certificate is basically validated by the website owner rather than a CA. While such an SSL cert will have the same level of encryption as the other options, anyone can create one. For your website users, there will be no trusted third-party verification to tell them that you are who you say you are. Furthermore, most web browsers display a warning message to users trying to access sites secured with this kind of cert. Unless you’re using it for a website that is strictly private, it is recommended that you go with one of the previously mentioned validation certs.

Another factor that will affect the type of SSL cert you choose is how many domains you need an SSL cert for. Each SSL certificate combines the level of validation we discussed in the previous section with the number of domains you want to protect. The four types of SSL types based on the number of domains are:

• Single-domain SSL certificates

• Wildcard SSL certificates

• Multi-Domain SSL certificates

• Unified Communications SSL Certificate

With a single-domain SSL certificate, a single domain and all the pages on that domain are protected. All three validation levels – DV, OV, and EV – are available for these kinds of certificates.

Namecheap’s offering for single-domain SSL certificates include: PositiveSSL; InstantSSL; and EVSSL.

With a wildcard SSL certificate, a single domain and unlimited subdomains for that domain are protected. For example, if you have an SSL certificate for “yourwebsite.com”, any subdomains you add, such as “mail.yourwebsite.com” or “login.yourwebsite.com” will automatically be secured. Even if you don’t have any subdomains currently, if you plan on adding any in the future, a wildcard SSL cert will save you money and hassle as you won’t need to keep on buying individual SSL certs every time you do so. Wildcard SSL certificates can be issued with DV and OV levels of validation, but not EV.

Namecheap’s offering for Wildcard SSL certificates include PositiveSSL Wildcard, EssentialSSL Wildcard and PremiumSSL Wildcard

With a multi-domain SSL certificate, up to 100 different domains are protected. Wildcard domains can also be protected with a multi-domain SSL cert. This kind of SSL cert is ideal for organizations running multiple websites, as they only have to deal with a unified cert for all of them, rather than keeping track of individual certs for each one. Getting this kind of cert will also save money in the long run.

Namecheap’s offering for multi-domain SSL certificates include PositiveSSL Multi-Domain Certificate and Multi-Domain SSL.

Unified communications (UC) certificates are similar to multi-domain certificates in that they can secure up to 100 domains and subdomains on one certificate. However, UC certificates are created specifically for environments that utilize Microsoft Exchange and Office Communications, and they use the Subject Alternative Name (SAN) extensions instead of different IP address to secure these domains.

Namecheap’s offering for UC Certificates is Unified Communications.

By now, you probably have a good idea of what kind of SSL certificate would best suit your website, but here are some things you should keep in mind when deciding what type of SSL certificate you should go for:

• The size of your website

• What kind of website it is

• How many domains you have

• How many subdomains you have

• If you work in a Microsoft Exchange and Office Communications environment

As a general rule of thumb, DV SSL certificates are best suited to small blogs and websites that don’t request personal data from its users. OV SSL certificates are best for small and medium-sized websites that request personal data from its users, particularly online stores. EV SSL certs are best for large enterprises with multiple, front-facing web properties.

Depending on the CA issuing your SSL certificate, you should also look at compatibility issues, whether or not they’re approved by popular browsers and compatible with mobile, for example.

Choosing the best type of SSL certificate for your website or websites doesn’t have to be an ordeal. By bearing in mind the size and scope of your website, and whether or not you need to secure multiple domains or subdomains, you should be able to make an informed decision and be safe in the knowledge that your website users’ data is protected.