How to Validate DigiCert and GoGetSSL Code Signing Certificates

DigiCert and GoGetSSL code signing certificates follow the same validation process. Whether you order an Organization Validation or an Extended Validation code signing certificate, the CA will use official government websites and third-party databases to confirm your company’s legal status. In rare cases, you might need to submit paperwork manually. Use the anchor links below to navigate between sections.

• Organization Validation (OV)
• Extended Validation (EV)
• Individual Validation (GoGetSSSL certificates only)

Organization Validation (OV)

The following quick guide will help you navigate the code signing Organization Validation in five easy steps:

1. Organization Authentication

DigiCert requires proof of your company’s legal registration and active status with the relevant authority to verify its existence. The name under which your organization is registered must match the information provided during enrollment. If you operate under a trade name or DBA (Doing Business As), ensure that all necessary fictitious registration filings are up-to-date. This enables DigiCert to proceed with the vetting process smoothly.

Quickest Way

Online Government Database: DigiCert verifies your business registration details and status by reviewing the official website of your country/state government where this information is publicly displayed. All the information on the enrollment must match precisely with the details found on the website.

Alternative Way

DigiCert accepts official business registration documents, such as Articles of Incorporation, Chartered Licenses, or DBA (Doing Business As) statements, issued by your local government. You can email these documents to [email protected] or fax them to +1-801-705-0481.

If your submitted documentation does not include your organization’s current address, it is necessary to provide a recent utility bill or bank statement. It should be addressed to your company and reflect the current address.

Common issues that may arise

• Official registration documents may have outdated or expired information.

2. Physical Address Verification

To ensure the authenticity of an organization’s physical presence within the registered country or state, DigiCert employs the following verification methods:

• Official Government Website: DigiCert thoroughly examines the official website of the relevant government authority at the country or state level. It accesses publicly available information displaying the business address, confirming its existence.
• Third-Party Directory: DigiCert also leverages reputable directories, both established and newly identified, such as GLEIF, Dun and Bradstreet, or YellowPages. The CA verifies that the information aligns by cross-referencing the provided business details with these directories, thus validating the physical address.

Common issues that may arise:

• Specific government databases or registration documents may not provide business addresses.
• Third-party directories might present outdated information regarding organizations.
• If the entity is registered via a third-party agency, such as offshore registration, the applicant may face difficulties verifying physical presence.

3. Phone Number Verification

DigiCert requires verification of a phone number belonging to the organization. This step ensures that the certificate request is legitimate and approved. To verify the phone number, DigiCert follows two possible avenues:

Quickest Way

Third-Party Directory: DigiCert can utilize an acceptable directory such as Dun and Bradstreet or YellowPages. No further steps are required if your organization’s verified business details match those listed in the directory.

Alternative Way

Official Government Website: If your official business registration documents include a phone number, DigiCert can rely on that information for verification. Ensure your telephone number is up-to-date to avoid any delays.

Common issues that may arise:

• No available listing in a third-party business directory.
• The telephone number provided by the third-party business directory is incorrect.
• The official government record does not contain a phone number.

4. Verification Call

Once you’ve passed the previous verification steps, DigiCert will call you or the company’s authorized representative as the final step in the authentication process.

DigiCert will initiate the call using the verified phone number from the third-party business directory or the official government website. We recommend you schedule a time for the call for quick and smooth verification.

Suppose DigiCert cannot reach an operator at the verified phone number. In that case, a voicemail will be left with a verification code and instructions for returning the call to complete this step. Add your name to your company’s directory and voicemail response to streamline communication.

Common issues that may arise:

• Representatives are unavailable to answer the call.
• The phone number uses an Interactive Voice Response (IVR) system or extensions to connect with a representative.

5. Final Approval

DigiCert double-checks all details to ensure accuracy. The final approval step, handled internally by DigiCert, typically does not require any input from the certificate requester. Once the final approval is concluded, you will receive an email with instructions on how to collect your certificate.

---

Extended Validation (EV)

Below are the steps required to obtain your Extended Validation Code Signing certificate. This guide provides a simple walkthrough of the process. To avoid interruptions, ensure all your company’s details are accurate and up-to-date in the government’s official databases and third-party listings.

1. Organization Authentication

To ensure the legitimacy of your business, DigiCert requires verification of your legal entity’s active registration in your country or state. It should match the provided information. Review the relevant registration filings before applying for the code signing certificate if you operate under a trade name or DBA (Doing As Business). Additional documentation may be necessary to verify the sole owner’s identity.

Preferred Way

• Online Government Database: DigiCert verifies your business entity registration status through the official website of your country/state.

Alternative Ways

• Official Registration Documents: Submit your business registration documents (such as Articles of Incorporation, Chartered License, or DBA Statement) issued by the local government.
• Legal Opinion Letter: If your business entity registration is not publicly available, you can obtain a signed letter from legal counsel or a professional/chartered accountant to verify its existence. The letter will also fulfill steps 2-4.

Common issues that may arise:

• Submission of incorrect business name.
• Outdated or expired official registration details.
• Sole proprietors from the United Kingdom are ineligible.
• Inability to complete alternative verification methods.
• Reluctance to pay for legal/accountant signature on the letter.

2. Operational Existence Confirmation

DigiCert has to verify that your legal entity has been active for at least three years. If your business is younger, then alternative verification methods are required.

Preferred Way

• Online Government Database: DigiCert examines the official website of your country/state that publicly displays your incorporation data.

Alternative Ways

• Official Registration Documents: If you have been operating for over three years, but the incorporation date is not visible, you can provide business registration documents (such as Articles of Incorporation, Chartered License, or DBA Statement).
• Dun & Bradstreet: If your business is younger than three years, DigiCert can use a comprehensive DUNS Credit Report, regardless of the registration date.
• Bank Confirmation Letter: For companies younger than three years, you can submit a letter from a local financial institution verifying that your legal entity holds an active checking account (demand deposit).
• Legal Opinion Letter: If the incorporation date is not visible or the company hasn’t reached the three-year timeframe yet, you can obtain a signed letter from legal counsel or a professional/chartered accountant to verify the existence of your business. The letter will also satisfy steps 2-4.

Common issues that may arise:

• Outdated entity details displayed by Dun & Bradstreet.
• Unwillingness to visit the local bank to complete a letter with a bank agent.
• Refusal to pay for a legal/accountant signature on the letter.

3. Physical Address Verification

Your legal entity must have a registered physical presence in the country/state. DigiCert must confirm the accuracy of the street address, city, state, and country. P.O. Boxes are not accepted.

Preferred Way

• Online Government Database: DigiCert examines the official website of your country/state that displays your business entity’s physical address.

Alternative Ways

• Official Registration Documents: Submit business registration documents (such as Articles of Incorporation, Chartered License, or DBA Statement) issued by the local government.
• Dun & Bradstreet: DigiCert can use a detailed DUNS Credit Report to verify the physical address associated with your business entity.
• Legal Opinion Letter: If your business entity registration is not publicly available, you can obtain a signed letter from legal counsel or a professional/chartered accountant to verify its existence. The letter will also fulfill steps 2-4.

Common issues that may arise:

• Some government databases or registration documents may not list the business’s address.
• Dun & Bradstreet might display outdated entity details.
• Reluctance to pay an extra fee for a legal/accountant signature on the letter.
• The entity is registered via a third-party agency (e.g., offshore), and the applicant can’t check physical presence.

4. Phone Number Verification

You must have an active telephone number listed in accepted telephone directories online. The listing must display your verified business name exactly, including the corporate identifier (e.g., Inc., LLC) and physical address.

Preferred Way

• Online Government Database: DigiCert checks the official website of your country/state that publicly displays your business entity’s telephone number.

Alternative Ways

• Third-Party Directory: DigiCert can verify your telephone number using an existing or new listing in acceptable directories (e.g., YellowPages) as long as the verified business details match.
• Dun & Bradstreet: DigiCert can use a DUNS Credit Report to validate the telephone number associated with your business entity.
• Legal Opinion Letter: If your telephone number is not visible, you can obtain a signed letter from legal counsel or a professional/chartered accountant to verify its existence. The letter will also fulfill steps 2-4.

Common issues that may arise:

• Most online government databases do not display telephone numbers.
• Telephone listings in third-party directories or Dun & Bradstreet may have outdated entity details or telephone numbers.
• Reluctance to pay extra for a legal/accountant signature on the letter.

5. Verification Call

DigiCert needs to speak with you or the designated applicant using the verified business telephone number to confirm the order details.

Preferred Way

• Verified Business Telephone Number: DigiCert uses the telephone number obtained from an acceptable telephone directory to contact you. You can book a phone call with DigiCert at a time that suits you.

Alternative Ways

• Extension or IVR: If the verified telephone number is not your direct line, DigiCert can enter an extension (if provided) or follow an Interactive Voice Response (IVR) system to reach you directly.
• Transfer or Alternative Telephone Number: If the verified telephone number is not your direct line, DigiCert can either be transferred or obtain another telephone number from a colleague after initiating the call using the verified telephone number.

Common issues that may arise:

• Inability to answer the telephone during regular operating hours.
• Lack of an operator or colleague to transfer/provide an alternative telephone number for contact.

6. EV Aprovver Form Submission

Once all validation steps are completed, DigiCert will send an email to the certificate requester, requesting their approval for the certificate. Sign the Acknowledgment of Agreement Form and submit it to DigiCert.

7. Final Approval

After completing the validation process, DigiCert reviews all the details for accuracy before issuing the certificate. This step, handled internally by DigiCert, usually does not require any input from the certificate requester. Once it’s complete, you will receive email instructions on how to collect your certificate.

---

Individual Validation (GoGetSSSL certificates only)

To acquire a GoGetSSL code signing cert as an individual, you need to follow three key steps:

Confirm Your Identity

In this step, the Certification Authority (CA) makes sure you are who you say you are. They’ll send you an email with an attestation letter. Just fill it out and use your webcam for a quick video check. The CA will look at your photo ID and ensure you’re the same person in the ID.

You’ll also need to provide one or two types of IDs. If you have a passport with your name and photo, that’s all you need. If not, you’ll need two IDs: one official ID with your name and picture (like a driver’s license, a Military ID Card, or a National/State ID card) and a second ID with your name (like a utility bill, a medical card, or a student ID badge).

Pass Phone Verification

After your identity is confirmed, you’ll move to phone verification. Just prove that your phone number works (it is valid and active). Google Business source is accepted for this purpose.

Final Verification Call

The last step is a simple phone call. An agent from the CA will call you to confirm your application details. All you have to do is answer a few questions.

Once you’ve provided the necessary documents and IDs (either a passport or two different IDs), you’ll be all set with Individual Validation.

---

Conclusion

DigiCert’s verification process for code signing certificates, whether Organization or Extended Validation, is quick and hassle-free. DigiCert uses official government websites and third-party databases to confirm an entity’s legal status and physical existence, leaving no room for doubt.

Although rare instances may require manual submission of paperwork, the overall procedure is quick and easy. All you have to do is provide up-to-date information about your company, and you’ll get the code signing certificate in one to three business days.