Here we go: There's essentially 3 types of certificate: DV - Domain Validation. The cheap, automated ones. Certs contain no more than the domain name they're

Here we go: There's essentially 3 types of certificate: DV - Domain Validation. The cheap, automated ones. Certs contain no more than the domain name they're issued to, and the whole process is automated. OV - Organisational Validation. The original 'standard' of certs, that most CAs issued until a few years back. Domain ownership checked, business checked (for legal existence and verified address). EV - Extended Validation. The new 'green bar' standard. Lots of hoops to jump through - agreements, legally-notarised letters, checking of business existence with local govt. & third parties, phone number verification, verification that the person requesting the cert actually has the right to do so....and so on. The question then becomes: why? The OV and DV sadly appear the same to the user. A few years back, one CA decided to issue the certs purely based on domain checking. Automation = cheap certs = big, fast marker share. It took, they made money. Then a time came to do something about the DV certs (ie making the browser chrome showing them 'less' secure or similar). By this time, the big boys in the CA world had aquired the company and had a pretty penny invested in the DV certs not becoming the red-headed stepchild. So the CAs and the browser and the OS people invented EV. There's still talk that DV will be 'downgraded' one day, but we'll see. Other types: Wildcards as someone mentioned will cover unlimited subdomains of the domain they're issued to (traditionally certs are for single FQDNs). Then we've got the new UCC for MS Exchange/OCS which has multiple, unique FQDNs in a single cert. Then you've got client & email certs, code-signing, and more :)