What is Organization Validation?
Also known as: OV
Organization Validation (OV) is a PKI certificate that requires proof of domain control and legal entity verification, offering more trust than DV but less than EV.
Organization Validation (OV) is a class of X.509 TLS certificate that combines domain control validation with verification of the requesting organization's legal existence and operational status. Unlike Domain Validation (DV) certificates, which only confirm control over a domain name, OV certificates require the certificate authority to check business registration records, physical address, and telephone contact. This process typically involves submitting official documents such as articles of incorporation or a business license, plus a phone call to a listed organization representative.
The validation workflow follows the Baseline Requirements set by the CA/Browser Forum. After the CA confirms both domain control (via DNS, email, or HTTP challenge) and organizational identity (via government registries or third-party databases), it issues a certificate whose Subject field includes the organization name, locality, and country. Browsers do not display a special indicator for OV certificates, unlike Extended Validation (EV) which turns the address bar green. However, OV certificates provide legal recourse: if the certificate is misused, the CA has verified a real entity that can be held accountable.
In the PKI hierarchy, OV sits between DV and EV. It is commonly used by businesses, non-profits, and government agencies that need to reassure users of their identity without implementing the stricter EV process. OV certificates do not affect encryption strength, which depends on the key size and cipher suite, but they do influence trust decisions made by relying parties and security scanners.
Key facts
- Requires both domain control validation and verification of legal organization existence.
- CA/B Forum Baseline Requirements mandate physical address and phone verification for OV.
- OV certificates include organization name in the Subject field, but no browser UI indicator.
- More expensive and time-consuming than DV, but less rigorous than EV.
- Commonly used for public-facing websites of registered businesses and institutions.
How it works in practice
Related terms
References
More in TLS & PKI
ACME Protocol
ACME (Automated Certificate Management Environment) is a protocol that automates the issuance, renewal, and revocation of TLS certificates, defined in RFC 8555.
Certificate Authority
A Certificate Authority (CA) is a trusted entity that issues digital certificates after verifying that the requester controls the domain or identity named in the certificate.
Certificate Chain
A certificate chain is an ordered list of certificates, starting with the server certificate and ending with a root CA, that a client validates to establish trust in the server's identity.
Certificate Pinning
A security technique where an application trusts only a specific, pre-selected certificate or public key for a given server, bypassing the standard chain of trust.
Cipher Suite
A cipher suite is a named set of cryptographic algorithms negotiated during a TLS handshake, specifying key exchange, authentication, encryption, and integrity protection for secure communications.
Domain Validation
Domain Validation (DV) is the lowest level of certificate validation used in TLS/SSL, where the certificate authority verifies only that the applicant controls the domain name, typically via an HTTP or DNS challenge.
ECH
Encrypted Client Hello (ECH) is a TLS extension that encrypts the Client Hello message, including the Server Name Indication (SNI), to prevent on-path observers from learning the target hostname during the handshake.
Extended Validation
Extended Validation (EV) is the highest level of TLS certificate assurance, requiring the certificate authority to perform rigorous, human-verified checks on the legal identity and operational existence of the requesting organization before issuance.
HSTS
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces browsers to interact with a website only over HTTPS, preventing downgrade attacks and cookie hijacking.
Intermediate Certificate
An intermediate certificate is a subordinate CA certificate signed by a root CA, used to sign end-entity certificates and enable path validation while the root remains offline.