A certificate authority offers domain-validated, organisation-validated and extended-validation certificates: what does each level actually verify?

## What all three levels share A validation level is a statement about **how hard the authority looked before signing**, and nothing else. At every level the applicant submits a certification request, the authority verifies the proof of possession, and the certificate binds the submitted public key to the names the authority was willing to vouch for. The key algorithm, the key size and the strength of the resulting connection are chosen independently of the validation level. A connection using a domain-validated certificate is not weaker, slower or more breakable than one using an extended-validation certificate. What differs is the **identity assurance carried in the subject** — and, crucially, how much of that assurance any party downstream can actually act on. ## Domain validation Domain validation answers exactly one question: *can this applicant act on this name?* The authority requires the applicant to perform an act that only someone with control of the name could perform — changing what the name serves or resolves to, or answering at an address published for the domain — and if the act succeeds, the authority is willing to bind a key to that name. Notice what it does **not** establish: - It does not establish who the applicant is. No person or company is identified. - It does not establish ownership. Control is not ownership; whoever operates the name today passes, including someone who has taken it over. - It does not establish that the operator is honest or that the site is safe. This is the level nearly all of the public web runs on, and it is the right level for it: it is exactly what a client needs in order to know the key it is talking to belongs to the name it asked for. ## Organisation validation Organisation validation keeps the control-of-name check — it does not replace it — and adds a second, unrelated investigation into a **legal entity**. The authority checks that the organisation named in the request exists in an official registry, confirms details such as its registered address through independent sources, and confirms that the applicant is connected to that organisation. The result is that the `subject` carries an organisation name a third party has actually checked, rather than one the applicant typed. ## Extended validation Extended validation is organisation validation performed under a stricter, published procedure with less discretion left to the authority, and with additional identifiers in the `subject` — the jurisdiction of incorporation and the registration number that ties the name in the certificate to a specific entry in a specific registry. That last part is the real technical difference: an organisation name alone is ambiguous across jurisdictions, while a jurisdiction plus a registration number is not. | Level | Control of the name | Legal entity checked | What the subject carries | |---|---|---|---| | Domain validation | yes | no | the name only | | Organisation validation | yes | registry check plus applicant link | a vetted organisation name | | Extended validation | yes | stricter specified procedure | organisation, jurisdiction, registration identifier | ## Why the distinction shrank The higher levels were sold on the idea that a client would surface the vetted identity to a human, who would then make a judgement about it. That interface treatment was retired after it became clear people did not read it and that a correctly obtained certificate for a plausible-looking entity name would pass the same check. Two consequences follow: 1. The extra vetting is now visible only to software that deliberately reads the `subject`, or to a human who inspects the certificate — which almost nobody does during normal browsing. 2. Because higher-level issuance is manual and slow, it works against short lifetimes and automated renewal, which are the operational habits that actually reduce risk. ## Where the levels still earn their place - Where a **relying party is a program you control** and can be made to check the organisation identifiers deliberately — a partner integration, a payment or reporting interface, a regulated submission channel. - Where a rule imposed on you by a counterparty or a regulator names the level, which is common where a named legal entity must be provable to an auditor. - Where the certificate is the evidence trail rather than the transport: a statement whose value lies in naming which legal entity stood behind it years later. For everything else, the honest answer in an interview is that the level does not change what the connection guarantees, and that operational habits — short lifetimes, automated renewal, controlling who can obtain a certificate for your names at all — buy more than the vetting tier does.