DV Certificate Download
Certificate Issued
Once both domain verification is complete AND the Administrator has approved the order, emSign issues the certificate. The Order Actions list on the emSign Subscriber Portal updates to show all four steps as Completed (green), and Step 4 - Certificate Download becomes active.
The Order Details sidebar on the right updates to show:
Order Status: Order Accepted (orange - this is normal at this stage)
Certificate Status: Certificate Generated (green) - this is the key status confirming your certificate exists and is ready to download
Downloading the Certificate
You can download the issued certificate in two ways: via the emSign Subscriber Portal (Step 4) or directly from CERTInext. Both methods give you the same certificate files.
Method A - Download via the emSign Subscriber Portal
Expanding the '4. Certificate Download' row shows a green 'Certificate Issued' badge and the following message:
📌 NOTE
Your certificate has been issued and ready for download. An email containing certificate download instructions has been sent to your email address. If you have not received an email, please click Resend Email to resend it. Your certificate is based on the CSR submitted by you. Please ensure to import / use the certificate against the same key-pair from where the CSR was generated.
Resend Email
Resends the certificate download notification email to your registered email address. Use this if you did not receive Email 2.
Download Certificate
Directly downloads the certificate from this page - without needing the email link.
Method B - Email 2: 'Your Certificate is ready for download'
A second email arrives at your Requestor Email ID (and delegated email, if set).
Email Details
Subject Line: ORDER #[your order ID] - Your Certificate is ready for download
Download Certificate button: Orange button - click to go directly to the certificate download page.
Download URL: A URL you can copy and paste into your browser if the button does not work.
💡 TIP
Save this email. The download link allows you to access the certificate directly at any time. If you miss it, use the Resend Email button in the emSign Subscriber Portal, or download directly from CERTInext via the 3-dot menu on your order.
Choosing the Download Format
Clicking the Download Certificate button (from the email or the emSign portal) takes you to the emSign download page. Click the orange Download Certificate button on that page. A popup titled 'Select the Format to download' appears with four options:
DER Encoded Binary X.509 (.CER)
A binary (machine-readable) format.
The file is not human-readable text.
Suitable for:
Java applications
Some enterprise systems
Older Microsoft environments
Base-64 Encoded X.509 (.CER)
A text-based format with a .CER file extension.
Human-readable text containing the certificate.
Suitable for:
Windows systems
IIS (Internet Information Services) web server
Base-64 Encoded X.509 (.CRT)
A text-based format with a .CRT file extension.
Same content as .CER - just a different file extension recognised by Linux servers.
Suitable for:
Apache
Nginx
Other Linux-based web servers
The most commonly used format.
Zip (Recommended if Unsure)
A compressed ZIP archive containing multiple certificate files:
Your server certificate
The intermediate CA chain certificate
The root CA certificate
Recommended if you are unsure which format to choose.
Provides all certificate files in one download.
💡 TIP
Which format should I choose?
Apache or Nginx (Linux): choose Base-64 encoded X.509 (.CRT)
Windows IIS or Microsoft environments: choose Base-64 encoded X.509 (.CER)
cPanel or Plesk (shared hosting): choose Base-64 encoded X.509 (.CRT)
If you are unsure: choose Zip - it contains everything and you can use whichever file you need
Choose the one applicable to your scenario based on the above description
⚠️ IMPORTANT
Your certificate file does NOT contain your private key.
Your private key was created on your server when you generated the CSR - it never left your server. The certificate file and the private key must BOTH be present on your server to enable HTTPS.
Never share your private key with anyone.
Wildcard and Wildcard UCC certificates: if you install the certificate on multiple servers (e.g., web server, mail server, API server), each server needs a copy of both the certificate file AND the matching private key.
Method C - Download Directly from CERTInext
Log in to CERTInext.
Go to Certificates > Orders in the left sidebar.
Find your certificate order in the list (Certificate Status should show 'Certificate Generated' in green).
Click View to open the order details.
Click the 3-dot menu in the top-right corner.
Select 'Download Certificate' from the menu.
Choose the one applicable to your scenario based on the above description
📌 NOTE
The 3-dot menu also shows 'Reissue Certificate' - this allows you to reissue the certificate (for example, if you need to provide a new CSR due to a key compromise) within the same validity period. The reissued certificate will have the same expiry date as the original. Contact your administrator before reissuing.
Final Order Status - The Order is Complete
After you download the certificate, return to CERTInext and check Certificates > Orders. Click View on your order. The status has now fully updated.
Order Status
Order Fulfilled (green badge)
Certificate Status
Certificate Downloaded (green badge)
Subscription Start Date
The date and time the certificate was issued (e.g., 27 May 2026, 10:30 UTC)
Subscription End Date
Exactly 1 year later (e.g., 27 May 2027, 10:30 UTC) - or the end of your selected validity period
Subscription Status
Active (green)
Issuer CA Information - Root CA
emSign QA SSL RSA CA - G1 (or similar emSign root CA name)
CA Type
Public
📌 NOTE
These details confirm your certificate was successfully issued by emSign and is now active. Your website is ready to be secured with HTTPS once the certificate is installed on your server.
Last updated