Extended Validation Certificates

In addition to performing the checks featured within Domain Validated Certificates, Extended Validation (EV) Certificates also includes validation of the business being associated with the certificate, and the standing of the Admin Contact within the business.

Extended Validation is applicable to the following SSL Certificates

• DigiCert EV SSL Certificate
• DigiCert EV Multi-Domain SSL Certificate w/ 2 SAN
• GeoTrust True Business ID EV SSL Certificate
• GeoTrust True Business ID EV Multi-Domain SSL Certificate w/ 4 SAN
• Thawte EV Multi-Domain SSL Certificate w/ 2 SAN

Eight steps are performed for Extended Validation EV SSL Certificates provide all the benefits of the Advantage SSL Certificates while also includeing prominent new trust indicators like a green address bar. Certificates

1. Acknowledgement Agreement
2. Authentication of the Organization Identity
3. Verify Operational Existence.
4. Address Authentication
5. Obtain Third Party Telephone Number
6. Verification of Certificate Contact
7. Confirmation of Domain Registration and Registrant / Organization name
8. Verification

Acknowledgement Agreement

Certificate Contact must sign and return the Acknowledgment Agreement (to the Vendor). To expedite processing, this Agreement includes the option to identify the Human Resources contact within the Organization. The HR contact will be contacted to complete the employment verification.

Authentication of the Organization Identity

The Organization’s full legal name as it is registered with a government agency must be verified and in good standing in the location listed in the Configuration data.

No misspellings or abbreviations are permitted

If the Organization cannot be verified using standard means, government-filed business registration documents may need to be produced.

Acceptable documents include:

• Articles of Incorporation
• Business License
• Charter Documents
• Fictitious Name Statement
• Registration of Trade Name

Verify Operational Existence

Organization must be registered and in existence for over 3 years. For Organizations in existence for less than three years, verification can be achieved via:

• A valid Dun & Bradsheet report
• Verifying the Organization has a demand deposit account, such as a chequing account via a document issued by a regulated financial institution, or a Professional Opinion Letter

Address Authentication

The Organization address must also be confirmed via a verifiable third party resource, which includes but is not limited to:

• Government Agency used during Organization Authentication
• Valid Dun and Bradstreet report
• Global Authentication and Verification Report
• A Professional Opinion Letter

Obtain Third Party Telephone Number

The telephone number must be under the Organization name, and must match the verified business address

The telephone number must be obtained through an approved resource

• 3^rd party Telephone number database
• Valid Dun and Bradstreet report
• Government POR database used to authenticate the Organization
• A Professional Opinion Letter

Verification of Certificate Contact

The Certificate Contact defined during the Configuration process will have their employment and authority within the Organization Entity / Organization verified.

It is recommended that the Certificate Contact’s email address be registered to the Organizational domain, or one of their verified Parent / Subsidiaries. A verification call with the Certificate Contact using a verified telephone number may be required.

The Corporate Contact’s employment can be confirmed several ways:

• If the Corporate Contact is listed as an office of executive of the organization in:
  • The Business Registration used during Organization Authentication
  • Valid Dun and Bradstreet report
  • Global Authentication and Verification Report
• Confirmation with the Organization’s HR department
• A Professional Opinion Letter

Authority indicates that the Corporate Contact is authorized to purchase the EV certificate on the behalf of the Organization.

• Authority of the Corporate Contact is confirmed if the Corporate Contact’s job title is confirmed in the Organization’s business filings or by Human Resources as someone with ‘deemed authority’, whereby ‘Deemed Authority’ is someone with the title of Director or higher
• Authority can also be confirmed in the Acknowledgment Agreement
• If the corporate contact is not someone with ‘deemed authority’, confirmation of the Authority can be confirmed with someone with ‘deemed authority’ or the individual Human Resources confirms as the Corporate Contact’s direct manager.

Confirmation of Domain Registration and Registrant / Organization name

The Registrant and Organization information submitted during Configuration must be an exact match. If an exact match cannot be facilitated, the domain administrator will be contacted via phone or email to confirm that the Organization has exclusive control of the domain.

Verification

A verification telephone call must be completed with the Certificate Contact. This call is placed using the verified third party telephone number confirmed during the Authentication process.

Next Step: "Issuance"