Organization Validation (OV) and the Verification Process
-
B
An Organization Validation (OV) certificate confirms both domain control and the organization’s identity. During validation, the Certificate Authority verifies that you control the domain, confirms that the organization is legally registered and active, and confirms that the request is authorized through a callback to a verified company phone number.
With all documents and information provided on time, the full process typically takes 1 to 3 business days.
-
1
Domain Control Validation
As with every certificate type, OV starts with proving you control the domain — this is the same DCV process used for DV certificates, completed via email, DNS (CNAME or TXT), or an HTTP/HTTPS file. For a full breakdown of how this works, see our dedicated article.
-
2
Organization Verification
This is the step that sets OV apart from DV: the Certificate Authority confirms that your organization legally exists and is properly registered. How this verification is handled depends on which CA is issuing your certificate.
-
DigiCert
DigiCert performs organization verification on its own. In most cases, DigiCert checks your company's legal existence directly against public government and business registries — no documents are required from you upfront. If DigiCert needs additional information or clarification, they will contact you directly.
-
Sectigo
Sectigo, on the other hand, requires you to submit verification documents yourself. Acceptable documents include Articles of Incorporation, a government-issued business license, or a recent company bank or utility statement. You upload them as PDF or JPG files through the link on your order page, in the Business Validation section.
Whichever CA handles it, organization verification covers two separate things about your company: that it legally exists and that it has a physical presence.
-
Legal existence
The CA confirms your organization is a registered, active legal entity. This is usually done through a government registry lookup — matching your registration number or company name in the official companies registry for your country — or through an existing LEI (Legal Entity Identifier) code registered with GLEIF, which speeds things up considerably and is the recommended option if you already have one — provided the LEI status is active. If a lookup isn’t possible, legal existence can also be confirmed from documents such as Articles of Incorporation or a government-issued business license.
-
Physical existence
The CA also confirms your organization has a real physical presence at its registered address. This can be established through a recognized business directory such as Dun & Bradstreet, or from a recent supporting document in the organization’s name — such as a utility bill, a bank statement, or a lease agreement.
-
-
3
Phone Verification (Callback)
The phone number is verified the same way as physical existence. Once the number is confirmed, the CA completes the callback as follows:
-
DigiCert
DigiCert calls the verified number to confirm that your organization ordered the certificate. If no one answers, they leave a verification code on your voicemail; you then call DigiCert back and read out that code to complete the check.
-
Sectigo
Sectigo sends you an email with a button to request the call and a field to enter a code. When you request the call, an automated system rings your number and reads out the verification code, which you enter in the email to complete the check.
-
-
*
Updating Company Information
If your organization's address or phone number has changed since your last certificate was issued, the CA will need to re-verify the updated details before issuing or renewing your certificate. To do this, you will need to provide a link to a public database where the updated information is listed — for example, your local companies registry or another recognized public registry.
You can submit this link directly to the CA, or provide it to GoGetSSL support and we will forward it on your behalf.
-
