Knowledge Base

Overview

After reading this article, you will know which actions you must complete so that Sectigo can issue your electronic IDentification, Authentication and trust Services (eIDAS) certificate. The article explains what eIDAS certificate validation is. It then describes the three applicant steps in order: accept the Subscriber Agreement, complete identity verification, and respond to the final validation contact. It also covers the organization validation that Sectigo performs at the same time, why validation is required, and what happens after validation is complete.

What is eIDAS certificate validation?

eIDAS certificate validation is the set of checks that Sectigo performs before it issues an eIDAS certificate. The checks confirm that the certificate is issued to the correct person and the correct organization. Most eIDAS applicants need to complete three steps. Sectigo performs the remaining validation work.

Steps to complete eIDAS certificate validation

Step 1: Accept the Subscriber Agreement

Shortly after you submit your eIDAS certificate order, Sectigo sends you a Subscriber Agreement. Review and accept the Subscriber Agreement.

• A natural person (an individual) must complete the Subscriber Agreement.
• An organization name, a department, or a generic mailbox cannot be used as the signer.
• This step usually takes less than one minute.

Step 2: Complete identity verification

After you accept the Subscriber Agreement for your eIDAS certificate, Sectigo may ask you to verify your identity. Identity verification confirms that the person linked to the eIDAS certificate request is the person they claim to be. Depending on the eIDAS certificate type, identity verification may include:

• Video-based identity verification
• Submission of supporting documents
• Other verification activities that eIDAS requires

Step 3: Respond to the final validation contact

Before Sectigo issues your eIDAS certificate, Sectigo may contact you by a verified email address or telephone number. Answer the email or call. The final validation contact confirms that:

• You requested the eIDAS certificate.
• You are the person named in the request.
• You have authority to act on behalf of your organization.

The final validation contact is usually short and may only require you to answer a few questions.

Organization validation that Sectigo performs

While you complete identity verification, Sectigo validates the organization linked to the eIDAS certificate request. You do not need to take action for this check unless Sectigo contacts you. Organization validation for an eIDAS certificate may include verification of:

• Legal existence
• Physical existence
• Operational existence
• Organizational authority

Sectigo uses qualified and reliable information sources, as required by eIDAS and by the standards of the European Telecommunications Standards Institute (ETSI).

Why eIDAS certificate validation is required

eIDAS certificate validation makes sure that:

• Sectigo issues eIDAS certificates only to verified individuals.
• The organization named in the eIDAS certificate is represented accurately.
• Unauthorized eIDAS certificate requests are stopped.
• Sectigo complies with eIDAS, European Telecommunications Standards Institute (ETSI), and industry requirements.

What happens after eIDAS certificate validation is complete

When all eIDAS certificate validation requirements are met, Sectigo completes these actions in order:

1. Sectigo approves the eIDAS certificate request.
2. Sectigo provisions a Qualified Signature Creation Device (QSCD), if your product requires one. A QSCD is a secure signing device.
3. Sectigo issues the eIDAS certificate according to the product requirements.
4. Sectigo sends you instructions for delivery and collection of the eIDAS certificate.

Frequently asked questions

Why is Sectigo contacting me about my eIDAS certificate?

Sectigo contacts you to confirm that you requested the eIDAS certificate and that you have authority to act on behalf of your organization. This final validation contact happens before Sectigo issues the eIDAS certificate.

Can someone else sign the eIDAS Subscriber Agreement for me?

The eIDAS Subscriber Agreement must be signed by a natural person (an individual) who has authority to act on behalf of the organization. An organization name, a department, or a generic mailbox cannot sign the Subscriber Agreement.

My organization is busy. Will eIDAS certificate validation take a long time?

No. Most of the actions that an eIDAS applicant must complete take only a few minutes. Sectigo completes most of the eIDAS certificate validation work in the background.

Related articles

eIDAS Citizen Certificate Validation: What to Expect During Validation | Sectigo® Official