Certificates and Verification

What does Verification mean?

 

When an SSL certificate is ordered, the first step in the process is called Verification (or Validation). Wesentra Ltd is authorized by Entrust to perform this step according to CA/Browser Forum guidelines and Entrust baselines and instructions.

After the order has been placed to the Entrust certificate services, the system sends email to the end customer. For example, if a new client is ordering certificates for their domain, the Authorizing Contact will receive an email containing a link to Subscription Agreement and Consent form. Authorizing Contact needs to accept these terms as a part of the process and acceptance will be verified by the Verification Specialists.

Wesentra Ltd has three accredited Verification Specialists who will do the verification checks using official publicly available and Entrust approved registries. In the Nordics these checks are carried out at local office hours and in Finnish, English and Swedish languages. This is a strictly controlled process and third-party sources are used accordingly. Verification cannot use for example information from the organization web sites.

OV verification steps:
  • Business check – Verifying that the Applicant organization is an active and legal entity and confirm that the Applicant has the right to use the business name submitted in the Organization field. Verification specialist checks the organization name, business id and status. OV certificates can only be used by such organizations who meet the requirements.
  • Domain check – The control of the domains needs to be proven with one of the following methods: Email, Web Server or DNS. Please find more details: Domain verification
  • Authorization Contact check – Using the third-party number, verification specialist will call the person in Authorization Contact role to confirm to confirm he/she accepted the online subscription agreement and consent form and that to confirm he/she accepted the Technical contact/Admin.

If the email address of the OV contact matches the extension listed in official registry this email address can be used to complete the final verification instead of final verification call.

EV verification steps:

As EV stands for Extended Validation, it requires a few more extra steps to complete. On top of the same checks that are carried out for OV, EV requires employment check for Higher Authority/Contact Person. This means that a verification specialist will verify that the person who has been appointed to Higher Authority/Contact Person role is employed by the organization and has the authority to authorize other persons to their roles. Verification checks are done using official publicly available and Entrust approved registries.

  • Business check – Verifying that the Applicant organization is an active and legal entity and confirm that the Applicant has the right to use the business name submitted in the Organization field. Verification specialist checks the organization name, business id and status. EV certificates can only be used by such organizations who meet the requirements.
  • Business Headquarters/Place of Business – Verification specialist will search a qualified independent information sources (in Finland The Business Information System YTJ and on an international level from official approved registries like Hoovers and Dunn & Bradstreet) to find the place of business address and main switch board phone number.
  • Domain check – The control of the domains needs to be proven with one of the following methods: Email, Web Server or DNS. Please find more details: Domain verification
  • Contract Signer/ Authorization Contact – Verification specialist will check that the person appointed to this role is employed by the organization and that he/she has received and accepted the Entrust Subscription Agreement and Consent Forms. Verification specialist also verifies that Contract Signer/Authorization Contact approves Certificate Requesters (technical administrators) to their roles.
  • Higher Authority / Contact Person - Verification specialist will verify that the director/manager level person who has been appointed to Higher Authority/Contact Person role is employed by the organization and has the authority to authorize other persons to their roles. Verification checks are done using official publicly available and Entrust approved registries.

Verification documents are sent over to Entrust to be audited and after they are approved, organization may receive certificates.

*) This example describes the verification process Wesentra Ltd does on behalf and in co-operation of Entrust. Entrust also audits all the verification work before approving it.