Extended Validation (EV) SSL certificates can take anywhere from 5 to 30 days to be issued (approximately).
The Certificate Authority (CA) Sectigo require all identity and corporate verification requirements to be satisfied before they'll consider issuing your EV certificate.
DUNS: Please note that your entity will REQUIRE a DUNS number in order to receive an EV SSL certificate, please contact Illion via csc.australia@illion.com.au for help.
If you already have a DUNS number for the entity that will be requesting the certificate, please make sure the details against it match those on the domain to be secured.
You need to be privy to sensitive information about the requesting entity, whether it's a Company (Pty Ltd), Association/Organisation (Inc), Sole Tradership (ABN) or otherwise. This will include having officeholders to sign agreements requesting the certificate's issuance amongst other documents, as well as your details being verified.
SOLE TRADERS: Please be aware that Sectigo need to verify your entity's legitimacy (ie. your Sole Tradership's ABN) as well as your personal identity due to your ABN's nature.
This involves personal information having to be shared with the Certificate Authority (CA), including but not limited to Government ID and utility bills - please see this Sectigo FAQ for more details. Please note that you'll need to be witnessed by a Justice of the Peace or otherwise registered notary or similar figure who carries a registration number (ie. a JP number) that can be verified with Government.
EV Validation basics consist of verifying the following:
- Organization legal name and status is in good standing
- Organization tradename / DBA (Doing Business As, T/A, etc) if applicable
- That the business is currently operating
- Address where you conduct business operations
- Organization main telephone number
- Control the domain(s) listed on the certificate
- Authenticity of the subscriber agreement
Tips when providing the organisation details for an EV certificate:
- Use the legally registered name of the organisation. Do not enter the trade name/DBA (doing business as) as the legal name of the company
- A trade name can be listed on the certificate with the legal name. The trade name/DBA (doing business as) must be registered in a government agency
- Use the address where the organisation conducts business. Do not use PO Box, mail stop/forwarding, care of, virtual office address or a registered agent address
While Sectigo is validating the organisation, you can expect:
- Complete Domain Control Verification to verify the domain(s) are controlled by the organisation.
This can be completed using 1 of 3 methods: DCV email, CNAME or HTTP(S) challenge. - Telephone call through the main business phone number to the signer listed on the subscriber agreement to verify the signature, authority to sign, if signer is an employee of the organization and signer's title
- An email with any additional actions if required
Reference: Sectigo knowledgebase
