How SSL Validation Works: DCV, OV and EV Checks and Issuance Times

How are SSL certificates validated? The certificate authority (CA) first confirms you control the domain, called domain control validation (DCV), using an email, a DNS record or a file on your website. For OV and EV certificates, the CA then verifies your organization in official registries and confirms it by phone before issuing.

The SSL certificate validation process follows the CA/Browser Forum Baseline Requirements (the rules every public CA must follow), plus the separate EV Guidelines for EV certificates. That is why the steps look the same no matter which brand you choose.

Validation level	What the CA checks	Typical speed driver
DV (domain validated)	Domain control only	How fast you complete DCV
OV (organization validated)	Domain + legal existence, address, phone	Whether your company records are listed and current
EV (extended validation)	Domain + extended organization checks per EV Guidelines	Documents, operational existence, callback and approval

How do I prove domain ownership for an SSL certificate?

You prove domain control with one of three methods: reply to an approval email sent to a standard address on the domain, publish a DNS TXT or CNAME record, or upload a file to your web server. DNS is the only one that works for wildcard certificates.

DCV method	How it works	Pros	Cons
Email	CA emails an address such as admin@ or webmaster@ on your domain; you click to approve	No technical changes	Mailbox must exist; being phased out (see below)
DNS TXT / CNAME	You add a record with a value the CA gives you	Works for wildcards; easy to automate	Needs DNS access; record must be visible to the CA
HTTP file	You place a file under /.well-known/pki-validation/	Quick if you control the web server	Not allowed for wildcards; redirects and firewalls can block it

DNS and SSL certificates: CNAME and TXT records

With DNS validation, the CA queries your domain’s DNS for a specific TXT or CNAME value. A CNAME can point to a value hosted by the CA, which makes repeat validations easier. If your DNS host uses long caching times, the record may take a while to become visible to the CA.

Tip: As of October 2026, the CA/Browser Forum is phasing out email- and phone-based DCV. WHOIS-based contacts can no longer be used since 15 July 2025 (ballot SC-080), and ballot SC-090 schedules the end of constructed-email validation (admin@, webmaster@ and similar) on 15 March 2028. Switch to DNS or HTTP validation now.

DCV results are reused for a limited time, and that window is shrinking alongside certificate lifetimes, down to 10 days from 2029. Automated DNS validation keeps renewals painless. You can read more about DCV-only certificates on our domain validated (DV) SSL page.

How are SSL certificates validated at OV level? The validation steps

An OV certificate adds organization checks to DCV. The CA must confirm that your organization legally exists, where it is located and that the person ordering is authorized to do so.

How long does it take to get an OV SSL certificate?

OV issuance depends mostly on how fast the CA can match your details to independent sources. If your business is listed correctly in a government registry and a business directory, it can be quick; missing or outdated records add back-and-forth. A typical OV timeline looks like this:

1. Order and CSR: you submit the certificate signing request and your organization details exactly as registered.
2. DCV: you complete email, DNS or HTTP validation for each domain.
3. Organization check: the CA looks up your legal registration (for example, a Secretary of State record).
4. Address and phone check: the CA confirms your address and finds your phone number in a qualified independent source, such as a business directory.
5. Verification call: the CA calls the listed number to confirm the request.
6. Issuance: the certificate is issued and emailed to you once every check passes.

What speeds up OV and EV validation?

• Verified listings: a current Dun & Bradstreet (D&B) profile with the right phone number and address.
• Exact names: the organization name in your order matches the registry, including suffixes such as “LLC” or “Inc.”
• Pre-validation: some CAs can validate your organization before you order, so later certificates only need DCV.
• Reachable contacts: someone answers the verification call and watches for CA emails.

What documents do I need for an EV SSL certificate?

For EV, you usually need nothing beyond accurate public records – but if the CA cannot verify a detail online, it asks for documents. The EV Guidelines require proof of legal existence, physical address, operational existence, a verified phone number and authorization of the requester.

EV check	What the CA verifies	Documents that may help
Legal existence	Registered, active organization	Articles of incorporation, registry extract
Physical address	A real place of business	Utility bill, bank statement, directory listing
Operational existence	The business is active	Bank confirmation letter or a professional opinion letter
Phone verification	Number from an independent source	Updated D&B or directory listing
Authorization	The requester may order for the company	Signed subscriber agreement, approver confirmation

A professional opinion letter from an attorney or accountant can cover several of these checks at once. See our EV SSL certificates if you need the highest identity level, or the overview of types of SSL certificates to decide whether EV is worth the extra steps.

How long does it take to get an SSL certificate?

DV certificates are usually issued within minutes once DCV completes. OV and EV take longer, because the timing depends on how quickly your records, documents and verification call can be confirmed. Delays almost always come from missing listings, name mismatches or unanswered calls, not from the CA’s systems.

How long does it take for an SSL certificate to work?

An SSL certificate works as soon as you install it and reload your web server. There is no global “SSL propagation” like DNS propagation; the server simply starts presenting the new certificate.

When people see the old certificate after installing a new one, one of these is usually the cause:

• The web server was not reloaded or restarted.
• A load balancer, CDN or proxy still serves its own copy of the certificate.
• DNS still points some visitors to an old server, until the record’s TTL (cache time) expires.
• The browser reused an open connection; a new window or private tab fixes this.

How long for an SSL certificate to update?

On your own server, the update is immediate after a reload. Behind a CDN or a managed host, it can take as long as that provider needs to deploy the certificate – check their dashboard. For the organization behind it, an organization validated (OV) SSL certificate is the step up from DV.