How to choose the right SSL certificate

Here’s the secret the certificate industry doesn’t lead with: every trusted certificate encrypts your traffic equally well. A free automated certificate and a premium extended-validation one use the same TLS, the same ciphers, the same padlock. What you’re actually choosing between are three practical things — how the certificate authority verifies you, which hostnames the certificate covers, and how issuance and renewal fit your setup. Get those three right and the product name takes care of itself.

What every certificate does

A publicly trusted certificate proves to browsers that the server they reached genuinely controls the domain, and it enables TLS encryption for everything in transit. Browsers reject the connection if the certificate doesn’t cover the hostname, has expired, or wasn’t issued by a trusted certificate authority. Those failures — not weak encryption — are what actually take sites down, which is why the workflow questions later in this guide matter more than the marketing tier.

Validation levels: DV, OV, and EV

Validation level describes how thoroughly the certificate authority checked who you are before issuing.

• Domain validation (DV) proves control of the domain, usually through an automated DNS or HTTP challenge. Issuance takes minutes. This is what automated certificate services provide, and it’s the right level for most websites.
• Organization validation (OV) adds verification of the legal entity behind the domain. Issuance involves real checks and takes longer.
• Extended validation (EV) applies the strictest identity vetting.

One thing worth knowing before paying for the letters: major browsers stopped giving EV certificates special visual treatment years ago. Visitors see the same padlock either way. OV and EV still make sense when a compliance framework, industry partner, or procurement policy requires verified organizational identity in the certificate — but that’s a paperwork requirement, not a security upgrade for your visitors.

Coverage: one name, wildcard, or multi-domain

Write down every public hostname you serve — the apex domain, www, and any subdomains like shop or app — then pick the smallest coverage that includes all of them:

Coverage	What it protects	Good fit
Single-name	One hostname (most include www alongside the apex)	A simple site with one public name
Wildcard	Every subdomain at one level, such as *.example.com	Many subdomains that come and go
Multi-domain (SAN)	A specific list of names, possibly across different domains	A handful of known names or several brands on one setup

Two details catch people out. A wildcard covers one level only: *.example.com matches shop.example.com but not staging.shop.example.com — and, less obviously, not the bare example.com itself, which is why wildcard certificates are usually issued with the apex included as an extra name. Check that yours is.

Issuance: automated, managed, or manual

How the certificate gets onto the server — and stays valid there — is the decision people skip, and it’s the one that causes outages.

• Automated (ACME) issuance, popularized by Let’s Encrypt, renews certificates with no human involved. If your platform supports it, this should be your default. Wildcard certificates over ACME require a DNS-based challenge, so the DNS provider needs automation support.
• Managed by the host means the hosting or CDN platform issues and renews certificates for you. Convenient and reliable — just confirm every hostname you care about is covered, not only the primary one.
• Manual issuance — purchase, validate, install, repeat at renewal — is sometimes unavoidable for OV/EV or for appliances that can’t run an ACME client. If you’re here, put the renewal date in more than one calendar and monitor the certificate that’s actually being served.

The industry is steadily shortening the maximum lifetime of public certificates, which means renewals are becoming more frequent for everyone. Every shortening makes manual renewal a little more painful and automation a little more valuable — when two options are otherwise equal, pick the one that renews itself.

Make the decision

1. Does a compliance or partner requirement demand verified organizational identity? If yes, you need OV or EV and should plan for a slower, document-based issuance. If no, DV is the practical answer.
2. How many hostnames, and how often do they change? A stable shortlist suits single-name or multi-domain certificates; a growing collection of subdomains suits a wildcard.
3. Can your platform automate issuance and renewal? If yes, use it. If no, decide who owns renewal and how you’ll notice a silent failure before your visitors do.

Once you’ve chosen, the HTTPS setup guide covers installation, redirects, mixed content, and renewal monitoring — the steps where certificate choices turn into a working, self-sustaining HTTPS site.

Sources and further reading

• Let’s Encrypt documentation
• Let’s Encrypt challenge types
• MDN: TLS configuration