OV certificates carry the policy OID 2.23.140.1.2.2 and subject attributes such as O (organization), L, ST and C. Validation follows Baseline Requirements §3.2.2.1–§3.2.2.3 using official registries, reliable data sources and verified contacts; it cannot be fully automated, so OV issuance usually involves an account with prior organization vetting. Organization data may be reused for up to 398 days.
Browsers no longer display the organization in the address bar, so OV mostly matters to people and systems that read the certificate: procurement and compliance requirements, mTLS deployments that map organizations to clients, and investigators tracing who operates a site.