Skip to main content

Organization Validation Instructions

Organization Validation is a core step in the SSL certificate issuance process. This document provides a detailed analysis of the organization validation mechanism for OV/EV certificates, covering the differentiated audit standards of leading global Certificate Authorities (CAs) to help enterprises complete validation.

Necessity of Organization Validation​

Organizations applying for OV/EV certificates are required to complete organization validation for the following main reasons:

Ensure the legality and authenticity of the applicant entity and prevent identity forgery‌‌​

CAs conduct manual reviews to verify the actual existence and legality of the enterprise and ensure the information is true and valid. This process can effectively prevent illegal actors from forging enterprise identities to obtain certificates and using SSL certificates to disguise themselves as legitimate websites for fraudulent activities‌.

Higher trustworthiness​

OV/EV certificates display the enterprise name in the certificate details, directly presenting the strictly verified enterprise identity‌. This visual cue significantly enhances users' perception of website trustworthiness, which is especially critical for sensitive scenarios such as e-commerce and finance.

Meet compliance and industry standard requirements​

Some industries (such as payment processing and healthcare) mandate the use of OV/EV certificates to comply with data protection regulations (such as PCI DSS and GDPR). DV certificates that have not passed organization validation cannot meet such compliance requirements‌

Organization Validation Requirements by Major Brands​

Sectigo / Positive / sslTrus Series Brands​

OV:
Sign the online agreement sent to the application email + Choose one of the following publicly available third-party phone numbers/emails:

  1. Phone number or email on Qichacha; (consistent with the enterprise annual report information);
  2. Phone number or email on Aiqicha;
  3. Phone number or email on Biaozhaozhao;
  4. Overseas enterprises: Phone number or email displayed on the website registered in Dun & Bradstreet (provided that the website is accessible)
  5. Create a Google Business Profile; the profile must be claimed by the customer and managed by an email address before it is accepted by the CA
  6. Attorney letter (using the CA-specified template). (For domestic enterprises)
    Note

    If the enterprise type is individual industrial and commercial household, remote video online validation is required. (Remote tool: MS Teams; the customer must hold their ID card during the process)

  7. Sign the online agreement sent to the application email
Update on OV validation rules for Sectigo/Positive/sslTrus series brands

The above are the validation rules updated by the vendor on June 2, 2025

EV:

  1. Phone number or email on Qichacha; (consistent with the enterprise annual report information);
  2. Phone number or email on Aiqicha;
  3. Phone number or email on Biaozhaozhao;
  4. Number directory: https://www.114best.com/
  5. Overseas enterprises: Phone number or email displayed on the website registered in Dun & Bradstreet (provided that the website is accessible)
  6. Create a Google Business Profile; the profile must be claimed by the customer and managed by an email address before it is accepted by the CA
  7. Attorney letter (using the CA-specified template). (For domestic enterprises)
    Note

    If the enterprise type is individual industrial and commercial household, remote video online validation is required. (Remote tool: MS Teams; the customer must hold their ID card during the process)

  8. Sign the online agreement sent to the application email

Digicert / Geotrust / Thawte Series Brands​

Note

Upon DigiCert's notice in April 2025, the attorney letter method will no longer be allowed when contact information is available on public third-party platforms, and attorney letters will not be accepted for organization validation. The attorney letter uses the CA-specified template and must be signed by a lawyer local to the enterprise's registration location.

OV for domestic enterprises:

  1. Phone number or email on Qichacha; (consistent with the enterprise annual report information);
  2. Phone number from 114 directory assistance;
  3. Phone number on Baidu Maps;
  4. Phone number on the official website (the official website must display the company name on a normal information page, and eligibility for use is subject to CA confirmation)
  5. Dun & Bradstreet phone number (commonly used by customers in Hong Kong or overseas);
  6. Attorney letter (using the CA-specified template); both the attorney letter and a stamped confirmation letter must be provided

OV for overseas enterprises:

  1. Phone number on Google Maps;
  2. Official website phone number (The official website displays the company name and is a normal information page; confirmation with the CA is required to check if it is usable)
  3. Dun & Bradstreet phone number (commonly used by customers in Hong Kong or overseas);
  4. Google Maps phone number
  5. Lawyer's letter (CA-specified template), which must be signed by a lawyer local to the enterprise's registration location.

EV domestic enterprises:

  1. Qichacha phone number; (synchronized with enterprise annual report information);
  2. 114 directory assistance phone number;
  3. Baidu Maps phone number;
  4. Dun & Bradstreet phone number (commonly used by customers in Hong Kong or overseas);
  5. Lawyer's letter (CA-specified template). Both the lawyer's letter and a stamped confirmation letter must be provided.

EV overseas enterprises:

  1. Google Maps phone number;
  2. Dun & Bradstreet phone number (commonly used by customers in Hong Kong or overseas);
  3. Google Maps phone number
  4. Lawyer's letter (CA-specified template), which must be signed by a lawyer local to the enterprise's registration location.
Note

All overseas enterprises must have a record on Dun & Bradstreet that matches the applying enterprise name.

Globalsign brand series​

OV domestic enterprises:
Primary method: Enterprise annual report phone number or email (independently verified by the CA) Other optional methods:

  1. Mail a password letter containing a verification code to the company's registered address (the courier will only show the registered address, and will not include the contact person's name or phone number);
  2. Legal opinion letter (CA-specified template).

OV overseas enterprises:

  1. Dun & Bradstreet information;
  2. Mail a password letter containing a verification code to the company's registered address (the courier will only show the registered address, and will not include the contact person's name or phone number);
  3. Lawyer's letter (CA-specified template), which must be signed by a lawyer local to the enterprise's registration location.

EV domestic enterprises:

Note

An additional signed application form (with official seal) & user agreement (with official seal) are required.

Primary method: Enterprise annual report phone number or email (independently verified by the CA) Other optional methods:

  1. Mail a password letter containing a verification code to the company's registered address (the courier will only show the registered address, and will not include the contact person's name or phone number);
  2. Legal opinion letter (CA-specified template).

EV overseas enterprises:

Note

An additional signed application form & user agreement are required.

  1. Dun & Bradstreet information;
  2. Mail a password letter containing a verification code to the company's registered address (the courier will only show the registered address, and will not include the contact person's name or phone number);
  3. Legal opinion letter (CA-specified template), which must be signed by a lawyer local to the enterprise's registration location.

CFCA brand series​

Ordinary enterprises: Application form (stamped) Government/public institutions: Application form (stamped) + handler's ID card + institution legal person certificate

Note

If a stamped application form cannot be provided, verification can be completed via the enterprise annual report phone number/email. In addition to annual reports, Baidu Maps, Tianyancha, 114 directory assistance, and lawyer's letters are also accepted.

Certum brand​

  1. Complete enterprise verification using a domain-suffix email. If the domain for the certificate request is racent.com, the applicant email used when submitting the ticket is in the format ****@racent.com, and the official website recorded when querying enterprise information on Qichacha is also racent.com, the enterprise email can be used directly for enterprise verification.
  2. Using a letter of authorization (materials provided by the customer)
  1. All information submitted when raising the ticket must be the customer's own information;
  2. The customer fills out the letter of authorization, with the contact name on the form matching the customer's own name in the order. After all information is completed, the form must be affixed with the official seal, and the front and back of the customer's own ID card must be provided.
Note

The Certum brand is temporarily delisted.

Tip
  • Digicert / Geotrust series: Support phone number verification via numbers registered on platforms such as Qichacha, Baidu Maps, and 114 directory assistance.
  • Some brands (such as CFCA, sslTrus domestic root) also support verification via stamped application forms.
Note
  • Phone numbers not registered on third-party platforms recognized by the CA cannot be used for verification.

:::

Last updated on