Choosing the right certificate

Every route ends in the same place: a private key on your server, and a certificate signed by a CA that vouches for the matching public key. Before you start, two decisions determine everything that follows — how much the CA verifies, and how many names the certificate covers.

DV — Domain Validated You prove you control the domain, nothing more. Issued in seconds, free. Covers ~99% of use cases, including e-commerce. Browsers show it identically to any other type.

OV / EV — Organization / Extended The CA also verifies your legal entity. Costs money, takes days, requires documents. Worth it only when a contract or compliance rule demands it — modern browsers no longer show a special indicator.

Single vs. wildcard vs. multi-SAN example.com vs. *.example.com (one level of subdomain only) vs. a list of unrelated names in one cert. Wildcards need DNS-based validation.

Then pick how it gets issued. If nothing forces your hand, take the automated path — it is faster, free, and renews itself.