How can an end user differentiate between OV (2.23.140.1.2.2) and DV (2.23.140.1.2.1) certificates?

The extensions and OIDs in question can be read with a run of command-line x509 -noout -text -in . When doing that regularly, you may want to be exact. Here is a snippet from my own Python 3 certificate helper tool:

known_policies = {
        '2.23.140.1.2.1': 'DV',
        '2.23.140.1.2.2': 'OV',
        '2.23.140.1.1':   'EV'
}
policy_re = re.compile(r'.*(2.23.140.1.[.0-9]+)', re.DOTALL)
ext = x509.get_extension()
if ext.get_short_name().decode('ascii') != 'certificatePolicies':
    # Other type of extension, not interested in that
    continue
policy_match = policy_re.match(str(ext))
if not policy_match:
    # Doesn't seem to contain valid policy information
    continue
policy_oid = policy_match.group(1)
type = known_policies[policy_oid]

The general idea is to use Python's OpenSSL library to read and load a X.509 certificate. Then iterate its extensions while looking for a certificatePolicies-extension. The expected normal condition is that there is one of the hard-coded OIDs in extension data.