Which SSL Certificate to Choose¶
The right question is not "which certificate is best" — it's what are you protecting. A personal blog, an online store and a corporate environment with dozens of subdomains all have different answers, and paying for validation your case does not need is money wasted.
The right question: what are you protecting?¶
| Scenario | What you need |
|---|---|
| A single site, no subdomains | Single-domain certificate (DV, OV or EV) |
A site with several subdomains (blog., app., store.) | Wildcard |
Several distinct domains (site1.com, site2.com.br) | Multi-Domain (SAN) |
| High-volume e-commerce or financial application | EV, alone or combined with Wildcard/Multi-Domain |
| Microsoft Exchange / Office Communications Server | UCC (a Multi-Domain product for that specific use) |
Not sure where to start¶
If none of the above answered your question, start with the two most commonly ordered certificates at InteSys:
- Positive SSL — single-domain DV, fast issuance, covers the domain and
www. Ideal for a corporate site, blog or landing page. - Positive SSL Wildcard — same DV validation, but covers the main domain and all its subdomains. Ideal if you already have, or plan to have,
blog.,app.,store.and similar.
Neither requires company verification or documentation — issuance is fast and covers most cases. If your site processes payments or handles sensitive data, look at OV and EV below before deciding.
Domain Validation (DV): issued in minutes¶
Confirms only that you control the domain — no company verification. It's the fastest level to issue, usually within minutes, and it's enough for the vast majority of sites: blogs, institutional pages, personal projects, staging environments.
The padlock looks identical to any other validation level — the trust difference lives behind the scenes, not in the address bar.
Organization Validation (OV): confirms the company¶
Beyond the domain, the CA confirms the company's legal existence through public records, which takes 1 to 3 business days. Recommended for corporate sites and online stores — the kind of site where a visitor might want confirmation that a real company stands behind it.
Extended Validation (EV): maximum trust¶
The strictest verification level, with extended company checks and issuance in 3 to 5 business days. Suited to banks, fintechs and high-volume e-commerce — where the cost of a fraud or a loss of trust is high enough to justify the extra verification.
Wildcard: one certificate for every subdomain¶
A single Wildcard certificate (*.yourdomain.com) protects the main domain and any first-level subdomain, present or future, without issuing or renewing a certificate per subdomain. It covers www, blog, app, store — automatically, with no need to list each one.
The validation level (DV, OV or EV) is chosen independently of Wildcard coverage — a Wildcard can be DV or OV, depending on how much verification the case calls for.
Multi-Domain (SAN/UCC): several distinct domains¶
Unlike Wildcard, Multi-Domain (also called SAN — Subject Alternative Name) protects distinct, unrelated domains listed explicitly on a single certificate: mycompany.com, mycompany.com.br and anotherbrand.com, for example. Useful for operations with several brands or several regional domains managed by the same team.
UCC (Unified Communications Certificate) is a specific Multi-Domain product, with a name that doesn't mention "SAN" anywhere — but it uses exactly the same underlying mechanism (Subject Alternative Name) as the rest of that category. It was originally designed for Microsoft Exchange and Office Communications Server, environments that need a single certificate covering several internal server names (autodiscover.domain.com, mail.domain.com, etc.).
What's included — the difference most people miss¶
Single-domain includes www at no extra cost
Single-domain certificates — DV, OV and EV, but not Wildcard or Multi-Domain — automatically cover both yourdomain.com and www.yourdomain.com, at no additional cost and with no need to list www separately. It's a product characteristic, confirmed against Sectigo's own documentation, and most buyers don't know they can count on it.
That rule does not apply to Multi-Domain: if you need www.yourdomain.com covered, it has to be one of the domains explicitly purchased/included on the certificate — it doesn't come for free. Wildcard, on the other hand, covers www trivially, because www is just another first-level subdomain within what *.yourdomain.com already protects.
Comparison table¶
| Feature | DV | OV | EV |
|---|---|---|---|
| What is verified | Domain only | Domain + company's existence | Domain + company + extended verification |
| Typical issuance time | Minutes | 1 to 3 business days | 3 to 5 business days |
| Padlock in the browser | Yes | Yes | Yes |
| Company name on the certificate | No | Yes | Yes, prominently |
| Suited for | Blogs, institutional sites, personal projects | E-commerce, SaaS, corporate portals | Banks, fintechs, high-volume e-commerce |
| Perceived trust level | Basic | High | Maximum |
Wildcard and Multi-Domain don't appear in this table because they aren't a validation level — they're a coverage format that combines with DV, OV or EV.
Next step¶
Once you've chosen the type, issuance moves through domain validation (DCV) and ends with installing the certificate on your server.
Compare prices and get the right certificate at InteSys SSL Certificates
Next Steps¶
- SSL Certificates — overview of the types and validity
- Domain Validation (DCV) — how domain control is proven
- Installing Your Certificate — trust chain and server configuration
- Code Signing & S/MIME — for software and email, not websites