What Is OV SSL?
OV SSL (Organization Validation SSL) is a mid-level SSL certificate where a Certificate Authority (CA) — such as GeoTrust, DigiCert, or Sectigo — verifies the applicant organization's identity before issuing the certificate. This vetting process is called Organization Validation and goes well beyond DV SSL, which only verifies domain ownership.
When a visitor clicks the padlock icon in their browser and views certificate details, they will see the company name and registered country embedded in the certificate. This provides verifiable proof that the website belongs to a real, vetted organization.
OV SSL is the right choice for business websites, companies, educational institutions, government agencies, and non-profit organizations that need to demonstrate a higher level of trustworthiness than DV SSL — without the stricter requirements and higher cost of EV SSL.
💡 Quick summary: OV SSL = SSL with an embedded organization seal — visitors can click to verify exactly which company owns the site.
OV SSL vs DV SSL vs EV SSL: Key Differences
SSL certificates are categorized into three validation levels, each offering different levels of identity assurance. Understanding the differences helps you pick the right certificate for your actual needs.
| Feature | DV SSL | OV SSL | EV SSL |
|---|---|---|---|
| Validation | Domain only | Domain + Organization | Domain + Strict Org Check |
| Company name in cert | ✗ No | ✓ Yes | ✓ Yes (stricter) |
| Issuance time | Minutes | 1–3 business days | 3–7 business days |
| Documents required | None | Company docs | Extensive docs |
| Warranty | $10K–$100K | $250K–$1.25M | $1.5M–$1.75M |
| Phishing protection | Low | Medium | Highest |
| Price (AsiaGB) | ฿1,000/yr | ฿4,000/yr | ฿7,000/yr |
| Best for | Blogs, personal sites | Business websites, SMEs | Banks, FinTech |
Importantly, the encryption strength is identical across all three types. All use TLS 1.2/1.3 and SHA-256. The difference is the level of identity trust communicated to visitors, not the cryptographic protection level.
How the OV Validation Process Works
When you apply for an OV SSL certificate, the CA follows a standardized vetting process defined by the CA/Browser Forum. Here are the key steps:
- Domain Control Validation (DCV): The CA confirms you control the domain — typically via an email sent to [email protected] or [email protected], or by adding a DNS TXT record to your zone.
- Organization Verification: The CA checks your organization name against official government databases — for Thai companies, this means the Department of Business Development (DBD) portal. The CA confirms the entity is legally registered and active.
- Phone Verification: The CA places a verification call to the phone number listed in a public directory (such as YellowPages or the government business registry) — not just the number you provide on the order form.
- Address Verification: The CA cross-checks your registered address against official documents and public sources such as Google Maps or government databases.
- CSR Validation: The CA reviews your Certificate Signing Request (CSR), specifically the Organization (O) and Country (C) fields, which must match your official registration documents exactly.
- Certificate Issuance: Once all checks pass, the CA issues the OV SSL certificate with your organization name and country embedded in the Subject Distinguished Name — visible to any visitor who inspects the certificate.
Required Documents for OV SSL
Document requirements vary slightly by CA, but for organizations in Thailand the typical requirements are:
For Companies and Partnerships (Juristic Persons)
- Company registration certificate from the Department of Business Development (DBD), issued within the last 3 months
- Document showing the company name, registered address, and business objectives
- A company phone number verifiable in a public directory (e.g., yellowpages.co.th or DBD online portal)
- CSR generated with RSA 2048-bit or ECDSA P-256 or higher
For Government Agencies, NGOs, and Educational Institutions
- Establishment charter, royal decree, or official operating license
- Official document showing the registered office address
- Main phone number listed on your official website or public directory
- CSR with O= field matching the official registered name
A critical point: the organization name in the CSR must exactly match the official registration documents, including legal suffixes like "Co., Ltd.", "Public Co., Ltd.", or their local equivalents. Mismatches cause delays or rejections.
Who Should Use OV SSL
OV SSL is best suited for organizations that want to display verified identity to visitors but do not require the extreme rigor of EV SSL.
Business Websites and SMEs
Mid-sized and small businesses with B2B or B2C customers — law firms, clinics, insurance brokers, consulting companies, and e-commerce stores that do not process payments directly through the site — all benefit from visitors being able to verify the company name in the certificate.
Employee Portals and External Intranets
Systems accessed by employees or partners from outside the corporate network — HR portals, CRM systems, reporting platforms, VPN login pages — benefit greatly from OV SSL. Employees can verify they are connecting to the legitimate organization server, reducing man-in-the-middle attack risks.
Educational Institutions and Non-Profits
Universities, schools, NGOs, and foundations that need to demonstrate their site belongs to a real registered entity without incurring EV SSL costs.
Regional and Local Government Agencies
Local government websites where citizens need assurance the site is genuinely run by the official agency, but where EV validation procedures may be impractical.
Who Should NOT Use OV SSL
- Personal blogs and portfolios: DV SSL is faster, cheaper, and sufficient.
- Banks, payment gateways, FinTech under phishing attack: Use EV SSL for maximum warranty and trust signals.
- Unregistered startups: You must have a legally registered entity before applying for OV SSL.
OV Wildcard SSL: What It Is and Who Needs It
OV Wildcard SSL combines the identity assurance of OV validation with the subdomain flexibility of a Wildcard certificate. A single *.example.com OV Wildcard certificate covers every subdomain at the same level:
- shop.example.com
- app.example.com
- mail.example.com
- api.example.com
- hr.example.com
It does not cover second-level subdomains like sub.shop.example.com — those require a separate Wildcard or a SAN certificate.
OV Wildcard vs DV Wildcard
DV Wildcard is faster and cheaper, but carries no organizational identity proof. OV Wildcard is the right choice for organizations running multiple subdomains that want visitors to see the verified company name across all of them — for example a business with separate app., api., shop., and mail. subdomains all on the same root domain.
⚠️ Note: There is no EV Wildcard SSL. The CA/Browser Forum explicitly prohibits issuing EV SSL as a Wildcard. OV Wildcard is therefore the highest validation level available in a Wildcard certificate.
OV SSL Pros and Cons
Advantages
- Verified company name in certificate: Visitors can inspect and confirm the site's owner — far more trustworthy than an anonymous DV certificate.
- Higher warranty than DV: GeoTrust True BusinessID carries a $1,250,000 warranty against CA-caused mis-issuance.
- Better phishing deterrent: Bad actors cannot obtain OV SSL without a real registered organization, making spoofing harder than with DV SSL.
- Wildcard option available: Manage one certificate for all subdomains under one domain.
- Reasonable cost: Higher than DV but far below EV — fits SME budgets well.
Limitations
- 1–3 business day issuance: Plan ahead before a launch deadline — not suitable for urgent needs like DV SSL.
- Requires a registered legal entity: Individuals or unregistered businesses cannot apply.
- Documents must be current: Company registration certificate must be no more than 3 months old.
- No visible browser indicator: Modern browsers no longer show a green bar or company name in the address bar. Visitors must click the padlock to see the organization name — unlike the old EV green bar era.
OV SSL and SEO: What You Need to Know
Google has used HTTPS as a ranking signal since 2014, and all certificate types (DV, OV, EV) provide the same direct SEO benefit. There is no documented evidence that OV SSL improves rankings over DV SSL directly.
However, OV SSL can improve SEO indirectly through user behavior metrics:
- Visitors who verify the company name in the certificate are more likely to trust the site and stay longer, reducing bounce rate.
- B2B prospects often inspect certificates before sharing sensitive information — OV passes this check easily.
- Higher trust → higher conversions → Google interprets the site as valuable → indirect ranking benefit over time.
In short, OV SSL does not boost SEO directly, but it builds the brand trust that improves engagement signals over the long term.
OV SSL Pricing at AsiaGB
AsiaGB offers OV SSL certificates from GeoTrust — a globally trusted brand under DigiCert — with full CA/Browser Forum compliant validation support for Thai and international businesses.
| Certificate | Type | Coverage | Warranty | Price/Year |
|---|---|---|---|---|
| GeoTrust True BusinessID | OV Single Domain | 1 domain | $1,250,000 | ฿4,000 |
| GeoTrust True BusinessID Wildcard | OV Wildcard | *.domain.com (all subdomains) | $1,250,000 | ฿15,000 |
- SHA-256 and TLS 1.2 / 1.3 support
- 99.9% browser compatibility across all browsers and mobile devices
- GeoTrust Site Seal included for display on your website
- Free reissues throughout the certificate lifetime
- SAN support available (add multiple domains to one certificate)
How to Apply for OV SSL at AsiaGB
- Generate a CSR: On your server, run
openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr. Enter your Organization name exactly as it appears in your company registration documents. - Place your order: Select your package at billing.in.th, submit the CSR, and fill in your organization details.
- Complete DCV: The CA will send a verification email to admin@ or webmaster@ at your domain, or provide a DNS TXT record to add. Choose the most convenient method.
- Submit organization documents: Send your company registration certificate and required documents via email or the CA's upload portal.
- Await phone verification: The CA will call the number listed in a public directory to verify your organization. Answer the call and confirm your details.
- Install your certificate: Once approved, the CA emails your .crt and .ca-bundle files. Install them on Nginx, Apache, or DirectAdmin following standard procedures.
Tips to Speed Up OV Validation
- List your company phone number on a public directory (yellowpages.co.th, Google Business Profile, or the DBD portal) before applying — the CA can verify it faster.
- Ensure the Organization (
O=) field in your CSR matches your DBD registration exactly, including "Co., Ltd." vs "Public Co., Ltd." suffixes. - Prepare a company registration certificate dated within the last 3 months — an expired one will require a new extraction from DBD before the CA can accept it.
- Do not change DNS records during the process — it can invalidate the DCV check and restart the process.
Frequently Asked Questions
How often does OV SSL need to be renewed?
Current CA/Browser Forum standards (2026) cap SSL certificate validity at 398 days (~13 months). Renew at least 30 days before expiry. AsiaGB sends reminder notifications at 60 and 30 days before expiration. Each renewal requires a full Organization Validation process again.
What happens to OV SSL if the company moves address?
The existing certificate remains valid until expiry, but the next renewal must use updated documents showing the new address. Operating with a significantly incorrect address in the certificate could undermine trust with visitors who inspect it.
Can OV SSL be used with a CDN?
Yes. OV SSL works with Cloudflare, BunnyCDN, and other CDN providers. You can upload the certificate to your CDN, or configure the CDN to proxy traffic to your origin server where the OV SSL is installed.
I need OV SSL across multiple subdomains — how many certificates do I need?
For multiple subdomains under the same domain, one OV Wildcard SSL (฿15,000/year) covers all of them. For multiple different root domains, consider an OV SAN (Multi-Domain) certificate, which covers several fully qualified domain names in a single certificate.
Does OV SSL work with Let's Encrypt?
No. Let's Encrypt is a DV-only CA and does not offer OV or EV certificates. If you need organization validation, you must use a commercial CA such as GeoTrust, DigiCert, Sectigo, or GlobalSign. Let's Encrypt is excellent for DV SSL but cannot verify organizational identity.
Get OV SSL for Your Business
GeoTrust True BusinessID OV SSL from ฿4,000/year · Wildcard from ฿15,000/year
AsiaGB's team guides you through the entire validation process.