Digital Certificates

OV certificates are the kind most commonly used to secure traffic on the internet (websites) and between different servers (e.g., firewalls, load balancers, and VPN devices). OV verification is based on using the certificate as a means to verify the organisation.

OV certificates reassure the person visiting your website:

-that they are definitely on a website made by your organization, and

-that the information they are entering in to your site will not fall into the hands of an outsider.

Information required for the OV process

The OV process is speeded if the following information is up-to-date in the public registers:

1. Official details of the company (name and street address). This name can be found in the trade register (in Finland for example) or official international business registers (such as Hoovers, or Dunn & Bradstreet).

2. Domain names you want to protect with the OV-level SSL / TLS certificate. Ownership of these domains must be verifiable in one of three ways:

• EMAIL
  To accept a domain via email, an email is sent to the address found in the domain’s WHOIS information or to a specific generic email address. The recipient accepts by simply replying to the email or opening the verification link in the message.
• WEB SERVER
  To accept a domain via web server, a small file is provided, with instructions for placing it on the web server under the domain address. The domain is accepted once the file is detected, the contents checked, and the contents are found to be correct.
• DNS
  To accept a domain via DNS, a series of letters and numbers is sent to the domain’s TXT record for DNS. The domain is accepted once the correct sequence of letters and numbers is identified.

3. Authorised contact person. This is the person who will confirm the authenticity of the application for the OV-certificate; is responsible for authorising the roles of the technical contact (admin); and is responsible  for receiving and confirming the online consent form. The authorised contact’s full name (including their title in English), telephone, email, and street address are required.

4. Technical contact (admin). This is the person who makes certificate requests on behalf of an organisation. There may be more than one, and often the authorised contact person also acts as a technical contact. The technical contact’s full name (including their title in English), telephone, email, and street address are also required.

EV certificates are used when an organisation needs to invest in greater security for their users or when the website in question requires important or personal information about the user. For instance, financial institutions and online stores are typically EV-certified.

EV certificates reassure a person visiting the website:

-that they are definitely on a website made by your organization, and

-that the information they are entering in to your site will not fall into the hands of an outsider.

Information required for the EV process

The EV process is speeded if the following information is up-to-date in the public registers:

1. Official details of the company (name and address). This name can be found in the trade register (in Finland for example) or official international business registers (such as Hoovers, or Dunn & Bradstreet).

2. Domain names you want to protect with the EV-level SSL / TLS certificate. Ownership of these domains must be verifiable in one of three ways:

• EMAIL
  To accept a domain via email, an email is sent to the address found in the domain’s WHOIS information or to a specific generic email address. The recipient accepts by simply replying to the email or opening the verification link in the message.
• WEB SERVER
  To accept a domain via web server, a small file is provided, with instructions for placing it on the web server under the domain address. The domain is accepted once the file is detected, the contents checked, and the contents are found to be correct.
• DNS
  To accept a domain via DNS, a series of letters and numbers is sent to the domain’s TXT record for DNS. The domain is accepted once the correct sequence of letters and numbers is identified.

3. Business HQ / place of business. The official address of the company’s headquarters, which can also be found via third party information (e.g., trade register or other official business registers such as Hoovers or Dunn & Bradstreet).

4. Higher Authority. This is someone in the company at a managerial level who who will confirm the authenticity of the application for the EV certificate, and is responsible for authorising the roles of the contract signer and authorised contact person. This person must be reachable by third party sources over the phone, and they cannot be the same person as either the contract signer or authorised contact person. The higher authority’s full name (including their title in English), telephone, email, and street address are also required.

5. Contract signer / certificate approver. These roles consist of receiving and confirming the subscription agreement and online consent forms, but they absolutely cannot be carried out by the higher authority. Contract signing and certificate approval can be carried out by different people, but if one person assumes both roles, it will speed up the verification process in the future.

6. Technical contact (admin). This is the person who makes certificate requests on behalf of an organisation. There may be more than one, and often the authorised contact person also acts as a technical contact. The technical contact’s full name (including their title in English), telephone, email, and street address are also required.

The lowest level of certification is Domain Validation (DV). In this case, the CA only checks if the certificate applicant has sufficient rights to the domain address they want the certificate for. The process is inexpensive, but not necessarily reliable. If an organisation wants to guarantee the authenticity of its certificates and minimise the risk of misuse, they should apply for OV or EV certificates.

Here’s an example. The name of the organisation doesn’t appear anywhere simply because no one has verified which organization set up the domain or authorised it.