Ordering OV Certificate - Draft

What Is an OV Certificate?

An Organization Validation (OV) SSL/TLS certificate does two things simultaneously: it encrypts all data flowing between your web server and visitors' browsers, and it proves to those visitors that your organization has been independently verified by a trusted Certificate Authority (the CA).

Unlike a basic Domain Validation (DV) certificate, which only checks that you control a domain name, OV certificates require the CA to confirm that your company or organization legally exists. This makes OV certificates the standard choice for corporate websites, customer portals, e-commerce stores, and any site where organizational identity matters.

The issuance timeline is typically 1-5 business days because the CA must complete the organization verification step. Once your organization is validated and stored in the system, subsequent OV certificate orders for the same organization can be processed faster.

The Four OV Product Variants - At a Glance

CERTInext offers four variants of the OV certificate, each designed for a different hosting scenario:

Feature	OV SSL Certificate	OV Wildcard SSL	OV UCC SSL	OV Wildcard UCC SSL
Domains Included (base)	1	1 wildcard	Up to 4	Up to 4 wildcards
Domain Format	domain.com	*.domain.com	Multiple domains	Multiple *.domain.com
Covers All Subdomains?	No (only www if enabled)	Yes - all subdomains	No - each listed separately	Yes - all subdomains per wildcard
www Variant Option	Yes (checkbox)	No (disabled)	Yes (checkbox)	No (disabled)
DCV Verifications	1	1	One per domain	One per domain
Add/Remove SANs post-issuance	No	No	Yes	Yes
Consent Confirmation Dialog	Not required	Required	Required	Required

Choosing the Right Product - Use OV SSL Certificate if you need to secure one specific domain (e.g., www.example.com). - Use OV Wildcard SSL if you need to secure a domain and ALL its sub-domains (e.g., *.example.com covers mail.example.com, shop.example.com, etc.). - Use OV UCC SSL if you need to secure several different domain names under one certificate (e.g., example.com + example.net + another-domain.com). - Use OV Wildcard UCC SSL if you need to secure multiple wildcard domains under one certificate (e.g., *.example.com + *.example.net).

Prerequisites - Before You Begin

Have the following ready before starting an application:

What You Need	Details / Where to Get It
CERTInext account	Log in at your organization's CERTInext portal URL. Your administrator provides login credentials.
Certificate Signing Request (CSR)	A CSR is a block of encrypted text generated on your web server. It contains your public key and basic organizational details. Generate it using your web server software (e.g., OpenSSL, IIS, cPanel) before starting the application. See Section 2.3 for details.
Domain name(s) to secure	Know the exact domain(s) you want the certificate to protect. For Wildcard, the format is *.yourdomain.com. For UCC/Wildcard UCC, list all domains upfront.
Organization details	Legal organization name, registered address, country, state/province, and locality - as they appear in official records. These must match what the CA verifies.
Organization representative info	Full name and contact details (email, phone) of the person who will act as the certificate subscriber.
Account credit or payment method	Sufficient account credit balance or a payment card for the Pay Online option.
Access to DNS provider (for DCV)	After payment you must prove domain ownership via DNS. You (or your IT/domain administrator) will need to create a DNS TXT record at your domain's DNS provider.

PHASE 1: Applying for the Certificate in CERTInext

This phase covers the seven-step application wizard inside CERTInext. Click New Certificate in the left navigation panel to begin. A side progress bar tracks your position through all seven steps.

Important - Progress Bar The left-side steps panel shows all seven steps. Steps with a - tick mark are completed. You can click Back at any step to return and edit without losing later data, except where explicitly noted.

Step 1 - Choose Product & Validity

This is the first screen you see after clicking New Certificate. You select which OV product to purchase and for how long.

1a. Common Fields (all four products)

Field / Option	What It Is	What To Do
Group	Your organization account name in CERTInext (e.g., ABC limited). This is pre-assigned and cannot be changed here.	No action needed - confirm this is your correct account.
CA Source	The Certificate Authority that will issue the certificate. emSign (eMudhra's trusted CA) is pre-selected.	Leave as emSign unless your administrator has configured an alternative.
Certificate Type	The category of certificate. SSL/TLS Certificates is pre-selected.	Leave as SSL/TLS Certificates.
Product	The specific certificate product you wish to purchase.	Click the dropdown and select the desired OV product. See Section 1.3 for guidance on which to choose.
Subscription For	The validity period of the certificate: 1 Year, 2 Years, or 3 Years.	Select the appropriate validity period. Longer subscriptions lock in pricing and reduce renewal effort. Note: industry standard maximum is 1 year for public trust, but multi-year subscriptions provide continuous coverage through automatic renewal.
Cost	The price for the selected product and validity period (in USD).	Auto-calculated. Review before clicking Next.

1b. Product-Specific Fields

Product Difference - No. of Domains field The 'No. of Domains' dropdown appears ONLY for OV UCC SSL and OV Wildcard UCC SSL. It is not present for OV SSL Certificate or OV Wildcard SSL.

Field / Option	What It Is	What To Do
No. of Domains (UCC & Wildcard UCC only)	Sets how many domains the certificate will cover. The default and minimum included in the base price is 'Upto 4'. You may add more during Step 5 at an extra per-domain cost.	Leave at 'Upto 4' if you need four or fewer domains. If you already know you need more, you can add them individually in Step 5 (Certificate Information).
Extra SAN note (UCC & Wildcard UCC only)	A note displayed beneath the Cost field informing you of the per-domain cost for SANs (Subject Alternative Names) beyond the included base: - OV UCC SSL: $84 USD per additional domain - OV Wildcard UCC SSL: $490 USD per additional domain	Take note of this cost before proceeding. Each extra domain added in Step 5 will increase the Grand Total accordingly.

1c. Certificate Features Panel

A blue information panel at the bottom of the screen describes what all OV SSL/TLS certificates include:

- Secures Single, Wildcard, Multiple Domains & Sub Domains

- Domain & Organization Validation

- Average Issuance Timeframe: 1-5 Business Days

- Unlimited Server Licenses

- Strongest SHA2 & ECC Encryption

- Major Browser & Mobile Device Compatibility

- Free Expert Support

- Automatic Renewal Reminders and Early Renewal Options

Action After reviewing all fields and the cost, click Next to proceed to Step 2.

Step 2 - Certificate Signing Request (CSR)

A Certificate Signing Request (CSR) is a file you generate on your web server before applying for the certificate. It contains your public key and basic identity information. The CA uses the public key in your CSR to create your certificate - the corresponding private key remains securely on your server and is never sent to anyone.

IMPORTANT NOTE displayed on screen The public key and signature algorithm from your CSR are used for certificate generation. Subject details such as Organization, Country, and State are pre-filled from your CSR for convenience but can be edited. The values you submit in the form will be the final values in the issued certificate.

Field / Option	What It Is	What To Do
Skip CSR	An option to bypass CSR submission at this stage if you do not yet have one prepared. The CSR will then need to be provided before the certificate can be issued.	Only use Skip CSR if specifically instructed by your administrator. In most cases, have your CSR ready before starting the application.
Upload CSR (Choose File button)	Upload a CSR file (.csr or .txt) directly from your computer.	Click Choose File, navigate to your saved CSR file, and select it. The CSR text will be loaded automatically.
Paste CSR (text area)	An alternative to file upload - paste the raw CSR text directly into this box.	Copy the full CSR text from your server (including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines) and paste it into this field.

CSR Format - What It Looks Like A valid CSR begins with: -----BEGIN CERTIFICATE REQUEST----- Followed by several lines of base64-encoded text. Ends with: -----END CERTIFICATE REQUEST----- Ensure you copy the entire block including the BEGIN and END lines.

Key Size Recommendation When generating your CSR, use a minimum key size of 2048 bits (RSA) or 256 bits (ECC/ECDSA). CERTInext shows the key size and algorithm from your CSR on the final order view. The screenshots in this guide show RSA 4096-bit keys.

Action After uploading or pasting your CSR, click Next to proceed.

Step 3 - Organization Information

This step links your certificate order to a legally verified organization. The CA will validate your organization's details before issuing the certificate.

Instant Issuance - Pre-validated Organizations If your organization has been previously validated by the CA, you will see an 'Instant' badge next to it and a green notice: 'You have 1 validated organization(s) - Instant issuance available.' Selecting a pre-validated organization skips the organization re-validation wait, significantly speeding up certificate issuance. New organizations require validation, which typically takes 1-3 business days.

Selecting Your Organization

The screen shows a list of your account's organizations. Use the tabs to filter: All, Validated, or Pending. Click the row of your organization to select it. The fields below will auto-populate.

Field / Option	What It Is	What To Do
Organization selector	A searchable list of organizations linked to your CERTInext account. Each entry shows the organization name, ID number, location, and validation status.	Click on your organization's row to select it. If you have only one organization, it will appear pre-selected.
+ Add a new organization	Button to register an organization that is not yet in the system.	Click only if your organization does not appear in the list. New organizations must complete a validation process (1-3 business days) before certificates can be issued. Fill in all required details carefully - they must match official legal records.
Organization Name *	The full legal name of your organization.	Automatically filled from the selected organization. Verify it matches your official registration exactly.
Organization Unit	The department or division within the organization (optional).	Leave blank if not applicable, or enter a relevant department name (e.g., 'IT Security', 'Operations').
Street Address 1 *	The first line of the organization's registered street address.	Automatically filled. Verify accuracy.
Street Address 2	Second address line (optional, e.g., Suite or Floor number).	Fill in if applicable.
Country *	The country where the organization is registered.	Automatically filled from the validated organization record.
State / Province *	The state or province of the organization's address.	Automatically filled. Select from dropdown if required.
Locality *	The city or locality of the organization's address.	Automatically filled. Verify it is correct.
Postal Code / Post Office Box Number *	The postal/ZIP code of the organization's address.	Automatically filled. Verify accuracy.

InCommon Note - Organization Details Accuracy The organization details entered here must exactly match the information on official government or business registration documents (e.g., company registration certificate, articles of incorporation). The CA will verify these details during the validation process. Discrepancies will cause delays or rejection of your application.

Action After selecting your organization and confirming the details are accurate, click Next.

Step 4 - Organization Representative Information

This step identifies the person who will act as the certificate subscriber - the individual who is responsible for the certificate on behalf of the organization. This person will receive all certificate-related emails including order confirmation, verification requests, and the download notification.

Field / Option	What It Is	What To Do
Choose User (New / Existing)	Toggle between creating a new user profile or selecting an existing one from your account. - New: Enter the representative's details manually. - Existing: Select from a pre-existing list of users in the system.	If this is your first certificate order or the representative is not yet in the system, choose New. Otherwise, choose Existing and select the appropriate user.
Name *	Full name of the organization representative.	Enter the person's legal first and last name. Avoid abbreviations.
Email ID *	The email address of the representative. This is where all certificate notifications will be sent.	Enter a valid, monitored business email address. All post-submission actions (consent, DCV, download) are triggered via this email. Do not use a shared or unmonitored mailbox unless someone actively reads it.
Mobile Number	The representative's mobile/phone number (including country code).	Select the country dial code from the dropdown, then enter the number. This may be used for identity verification by the CA.
CERTIFICATE DOWNLOAD DELEGATION	An optional section to designate a different person who is authorized to download the issued certificate on behalf of the representative.	Only fill in if the person who applied is not the same person who will download and install the certificate. Leave blank if the representative will handle the download themselves.
Contact name (Delegation)	Name of the person delegated to download the certificate.	Enter only if using Certificate Download Delegation.
Email ID (Delegation)	Email address of the delegated downloader.	Enter only if using Certificate Download Delegation. This person will receive the download notification email.

InCommon Note - Representative Email The email address entered here is the most critical field in this step. Every post-payment action - consent requests, domain verification instructions, and the final certificate download link - is sent to this address. Ensure it belongs to someone who will monitor it actively until the certificate is issued.

Action After completing the representative's details, click Next.

Step 5 - Certificate Information

This step shows a summary of your organization's details (auto-filled, read-only) and collects the domain name(s) the certificate will protect. This is where the four products differ most significantly.

5a. Organization Summary (Read-Only - All Products)

The top portion of this screen displays the organization details you confirmed in Step 3. These fields are informational only and cannot be edited here. If you notice an error, click Back to return to Step 3.

Field	Value shown (example)
Organization Name	Your organization's legal name (e.g., ABC limited)
Organization Unit	Department name or blank if not specified
Street Address 1	Registered street address
Street Address 2	Additional address details or blank
Country	Country of registration (e.g., United States of America (USA))
State / Province	State or province (e.g., California)
Locality	City (e.g., California)
Postal Code / Post Office Box Number	ZIP/postal code (e.g., 8765678)

5b. Domain Name Fields - Differences by Product

Product Difference - Domain Fields The domain entry section below the organization summary is the key difference between the four OV products. Read the sub-section for your chosen product carefully.

OV SSL Certificate - Single Domain

Field / Option	What It Is	What To Do
Automatically secure 'www' variant of websites	A checkbox that, when ticked, instructs the system to also secure the www.yourdomain.com version of your domain automatically, at no extra cost.	Tick this box if your website is accessed both with and without 'www' (which is the case for most websites). Leave unticked only if your domain is exclusively accessed without www.
Domain Name *	The single fully-qualified domain name (FQDN) the certificate will protect (e.g., shop.example.com).	Type the domain name exactly as it should appear in the certificate. Do not include 'http://' or 'https://'. Example: example.com or portal.example.com

InCommon Note - OV SSL Domain Enter only the base domain or subdomain you want to protect. A single OV SSL certificate covers exactly one domain. The 'Automatically secure www variant' checkbox adds www.yourdomain.com as an additional SAN (Subject Alternative Name) at no extra cost - tick it unless you have a specific reason not to.

OV Wildcard SSL Certificate - Single Wildcard Domain

Field / Option	What It Is	What To Do
Domain Name *	The wildcard domain in *.yourdomain.com format. The asterisk (*) represents any single subdomain label.	Enter the wildcard domain using the *.yourdomain.com format. Example: *.example.com - this will cover mail.example.com, shop.example.com, portal.example.com, etc. Do NOT include the asterisk if you want the root domain only; use OV SSL for that.

InCommon Note - OV Wildcard SSL Domain The 'www variant' checkbox is not available for Wildcard certificates because *.domain.com already covers www.domain.com (www is itself a subdomain). Note: a Wildcard certificate covers only ONE level of subdomain depth. *.example.com covers shop.example.com but does NOT cover deep.shop.example.com.

OV UCC SSL Certificate - Multiple Domains

Field / Option	What It Is	What To Do
Automatically secure 'www' variant of websites	Tick to also secure the www.yourdomain.com version of the primary domain automatically.	Tick if applicable for your primary domain.
Domain Name *	The primary (main) domain name the certificate will protect.	Enter your primary domain name (e.g., example.com).
Additional Domain Names *	A multi-entry field where you add all extra domain names beyond the primary domain. Each domain appears as a removable tag. The included base is up to 4 domains total (primary + additional). Beyond 4, each domain is charged at $84 USD.	Click inside the 'Select' dropdown/input box and type each additional domain, pressing Enter or clicking the '+' button after each one. You can also click 'Import additional domain' to paste or upload a list of domains in bulk. Click the - next to any domain to remove it.
Import additional domain (button)	Allows bulk import of multiple domain names at once instead of adding them one by one.	Click to open an import dialog. Paste a list of domain names (one per line) and confirm.
Clear (button)	Removes all entries from the Additional Domain Names list.	Use only if you want to start the domain list from scratch.

OV Wildcard UCC SSL Certificate - Multiple Wildcard Domains

Action After entering all domain name(s), click Next to proceed to Step 6.

Step 6 - Additional Information (Optional)

This step is the same for all four OV products. All fields are optional but some, such as auto-renewal, are pre-configured with sensible defaults.

Field / Option	What It Is	What To Do
Tags	Custom labels you can attach to this order for internal tracking and reporting within CERTInext (e.g., 'Production', 'Project-Alpha', '2026-Q2').	Click '+ Add Tag', type your tag text, and press Enter. Add multiple tags as needed. Tags are for your internal use only and do not appear on the certificate.
Order Remarks	A free-text notes field for any special instructions or internal references related to this order.	Type any notes relevant to your team or to support if you need to raise a query. This text is visible to the CA and CERTInext administrators.
Technical Point of Contact Information	Checkbox - expands to collect the name, email, and phone number of the technical person responsible for managing this certificate (e.g., the system administrator who will install it).	Tick and fill in only if the technical contact is different from the Organization Representative entered in Step 4. Useful for larger organizations where the certificate requester and the server administrator are different people.
KYC Documents	Checkbox - expands to allow you to upload Know Your Customer (KYC) verification documents (e.g., company registration certificate, utility bill, government ID).	Tick and upload documents if the CA requests them for your organization or if this is a new organization requiring validation. Providing these upfront can speed up the validation process.
Additional email recipients	Checkbox - expands to add extra email addresses that should receive certificate-related notifications.	Tick and add email addresses if others in your organization (e.g., a manager, security team) should also receive order status updates and the download notification.
Auto-renew certificates until coverage	Checkbox (ticked by default) - instructs CERTInext to automatically initiate certificate renewal before expiry, ensuring continuous HTTPS coverage without manual intervention.	Leave ticked (recommended). Only untick if you want to manage renewals manually.
Set renew criteria - Before [N] days of certificate expiry	Configures how many days before expiry the auto-renewal process begins. Default is 15 days.	Click the dropdown to adjust the lead time (e.g., 30 days gives more time for any renewal complications). 15 days is the standard minimum recommended.

Action Review and adjust any optional settings, then click Next to proceed to the Order Summary.

Step 7 - Order Summary & Payment

The final step before payment. Review everything carefully. A 'Payment Pending' badge appears in the top-right corner.

7a. Product Information Panel

Field / Option	What It Is	What To Do
Certificate Type	The category of certificate (SSL/TLS Certificates).	Verify this matches your intended purchase.
Product Name	The specific OV product selected (e.g., OV SSL Certificate, OV SSL Certificate Wildcard, OV SSL Certificate UCC, OV SSL Certificate Wildcard UCC).	Confirm this is the correct product variant.
Validity Period	The subscription duration selected in Step 1 (e.g., 1 Year).	Confirm the correct duration.
Domain Count	The total number of domains the certificate will cover.	For OV SSL and Wildcard SSL: 1. For UCC/Wildcard UCC: reflects the total number of domains entered in Step 5.

7b. Certificate Information Panel

A summary of all organization details and domain name(s) entered across previous steps. Scroll through to verify all values are correct. If anything is wrong, click Back to return to the relevant step.

7c. Payment Information Panel

Credit Usage Note A banner on screen states: 'On click of Use Credits button, amount will be deducted from [Your Organization] balance.' Confirm your account balance is sufficient before choosing Use Credit.

Field / Option	What It Is	What To Do
Current Balance	Your organization's current pre-paid credit balance in USD.	Verify you have sufficient balance if paying by credit. If the balance is less than the Grand Total, use Pay Online instead.
Certificate Price (upto 4) (UCC/Wildcard UCC only)	The base certificate price covering the included number of domains (up to 4).	Informational - auto-calculated.
Additional SAN Cost (UCC/Wildcard UCC only)	The additional cost for any domains beyond the included base quantity. Format shown: '$[rate] per [count]'.	Informational. Verify this matches the number of extra domains you added in Step 5.
Grand Total	The final total amount in USD payable for this order.	Verify this matches your expectation before proceeding to payment.
Subscriber Agreement checkbox	A mandatory checkbox confirming you have read and agreed to eMudhra emSign's Subscriber Agreement.	You MUST tick this checkbox before payment. Click the 'Subscriber Agreement' hyperlink to read the full terms if you have not done so.

InCommon Note - Subscriber Agreement Ticking the Subscriber Agreement checkbox is a legal acknowledgement that you agree to eMudhra emSign's terms and conditions for certificate issuance and usage. Read the agreement before ticking. The checkbox is mandatory - you cannot proceed to payment without it.

7d. Payment Buttons

Button	Action
Save and Exit	Saves your application as a draft and exits the wizard. You can return to complete payment later from the Orders list.
Pay Online	Opens a payment gateway to pay the Grand Total using a credit/debit card or other supported online payment method.
Use Credit	Deducts the Grand Total from your organization's pre-paid credit balance in CERTInext immediately. Order is submitted upon confirmation.

Action Tick the Subscriber Agreement checkbox, then click either Pay Online or Use Credit to submit your order. After successful payment, you will be taken to the Order View page.

PHASE 2: Post-Submission - What Happens After You Pay

After payment, your order enters a multi-step verification and issuance workflow. Most steps happen automatically or require brief actions from you via email links. This section explains every stage in sequence.

2.1 CERTInext Order View - Immediately After Payment

You are automatically redirected to the Order View page in CERTInext. Bookmark or note the Order ID displayed at the top - you will need it for any support queries.

Field	Meaning
Order ID	Unique reference number for your certificate order. Keep this safe.
Ordered Date	Date and time the order was placed.
Product	The OV certificate product ordered.
Group	Your organization account name.
CA Source	Certificate Authority: emSign.
Certificate Price	Total amount charged for this order (USD).
Order Status	'Order Accepted' (orange badge) - the order has been received and accepted for processing.
Certificate Status	'Pending for Approval' (orange badge) - the certificate is awaiting CA validation and issuance steps.

The lower portion of the Order View page shows detailed panels: SSL Subscription Information, Auto-Renewal Configuration, Organization Representative Information, Certificate Signing Request (CSR) Information, Organization Information, Certificate Information, Additional Information, and Renewal Notifications.

Note - Subscription Dates Subscription Start Date and Subscription End Date will be blank at this stage. They are populated once the certificate is issued and the subscription becomes Active.

2.2 Order Confirmation Email

Within minutes of payment, the Organization Representative receives an email notification confirming the order was placed successfully.

Email Field	Content
Subject	ORDER #[Order ID] - Your Order is Successful
Order ID	Your unique order reference number
Ordered Date	Date and time (UTC)
Product & Validity	Product name and subscription period
Identifier	The primary domain name secured by this certificate
Subscription Per	e.g., 1 Year(s)
Track Order button	Orange button linking to the emSign Subscriber Portal for your order

Action Click 'Track Order' to open the emSign Subscriber Portal where you will complete the remaining verification actions. You can also access this portal via the link in subsequent notification emails.

2.3 emSign Subscriber Portal - Order Actions Overview

The emSign Subscriber Portal is eMudhra's certificate management interface for subscribers. It shows the status of all five verification actions that must be completed before your certificate is issued.

The portal header shows your name and the Certificate Requester Information. The Order Details panel on the right shows Order ID, Product & Validity, primary Domain Name, Order Status, and Certificate Status.

The Five Order Actions

Step	Name and Description
1. Organization Verification	Confirms the organization details are accurate and the organization is validated by the CA. This is typically auto-completed if you selected a pre-validated organization in Step 3 of the application.
2. Submit CSR	Confirms your CSR was accepted. Auto-completed if you submitted a CSR in Step 2.
3. Subscriber Agreement	You must formally agree to the emSign Subscriber Agreement for this specific order. Status will show 'Awaiting Customer Action' until you complete it.
4. Domain Verification	You must prove you control each domain on the certificate. Status shows 'Awaiting Customer Action'. Covered in detail in Section 2.6.
5. Certificate Download	Available once all other steps are complete. Status progresses from 'Issuance Pending' - 'Certificate Issued'. Covered in Section 2.7.

InCommon Note - Action Status Colors Green = Completed. Orange = Awaiting Customer Action (you must do something). 'Issuance Pending' (orange) on step 5 means the CA is still processing - no action needed yet. Certificate Status in the right panel shows the overall progress: 'Pending for Approval' - 'Approved' - 'Certificate Generated'.

2.4 Organization Re-use Consent (If Applicable)

When your order re-uses a previously validated organization (which is the standard case when selecting a pre-validated organization in Step 3), the system requires the Organization Representative to formally consent to this re-use. This is a security measure to prevent unauthorized use of an organization's validated identity.

When Does This Apply? Consent is required whenever a new certificate order re-uses an organization's existing validated details and subscriber agreement. If this is your very first order for an organization that is being validated fresh, you will not see a consent request at this stage - the CA will contact you separately for validation.

2.4a Consent Required Email

The Organization Representative receives an email with the subject: 'ORDER #[ID] - Consent Required to re-use [Organization] Organization'.

The email contains the order details (Order ID, Ordered Date, Product & Validity, Identifier/domain, Ordered By, Organization Name, Organization Country) and a 'Click here' hyperlink to open the consent page.

Action Click the 'Click here' link in the email to open the emSign Consent page.

2.4b emSign Consent Page

The consent page displays:

- A notification message identifying the order, the organization being re-used, and the person who placed the order.

- Order details: Order ID, Date Ordered, Ordered By

- Organization details: Organization ID, Organization Name, Country

- Consent statement: 'Accepting this consent means that you allow this order to re-use your organization information & subscriber agreement.'

- Two buttons: Accept (orange) and Decline (red)

IMPORTANT - Accept or Decline If you recognize this order and authorize it, click Accept. If you did NOT authorize this order or do not recognize it, click Decline immediately and contact your CERTInext administrator. Declining will halt the certificate issuance for this order.

2.4c Consent Confirmation Dialog (OV Wildcard SSL, OV UCC SSL, OV Wildcard UCC SSL only)

Product Difference - Confirmation Dialog For OV Wildcard SSL, OV UCC SSL, and OV Wildcard UCC SSL orders, clicking Accept on the consent page triggers an additional Consent Confirmation dialog. This extra step does NOT appear for OV SSL Certificate orders.

A modal dialog appears asking: 'Are you sure you want to accept the consent?'

- Click Yes to confirm your consent.

- Click No to cancel and return to the consent page.

2.4d Consent Accepted Confirmation

After clicking Accept (and Yes in the confirmation dialog where applicable), a confirmation screen displays: 'Thank you for providing your consent to re-use [Organization Name].' This confirms the consent has been recorded.

Note - Subscriber Agreement Once consent is provided, the Subscriber Agreement step (Step 3 in the Order Actions) is typically auto-completed as part of the consent process. Return to the emSign Subscriber Portal to verify the status.

2.5 Subscriber Agreement

The Subscriber Agreement step confirms that the certificate subscriber has formally read and agreed to eMudhra emSign's terms and conditions for this specific certificate order.

In most scenarios where you re-use a validated organization and provide consent (Section 2.4), the Subscriber Agreement step is auto-completed as part of the consent workflow. If it still shows 'Awaiting Customer Action', click the '+' expand icon next to Step 3 to view and accept the agreement directly in the portal.

InCommon Note Once all of Steps 1, 2, and 3 show 'Completed' (green), the system proceeds to Step 4: Domain Verification. You may receive an email notification prompting you to complete domain verification.

2.6 Domain Control Validation (DCV)

Domain Control Validation is the process by which you prove to the Certificate Authority that you genuinely control each domain name listed on the certificate. No certificate can be issued until DCV is complete for all domains.

2.6a Domain List

When you expand Step 4 (Domain Verification), you see:

- 'Total Domains: [N]' - the count of domains requiring verification.

- Each domain listed with a status icon (orange warning = pending, green = verified) and a 'Verify' button.

- For OV SSL and OV Wildcard SSL: 1 domain to verify.

- For OV UCC SSL and OV Wildcard UCC SSL: one entry per domain - you must verify each domain individually.

Product Difference - Multiple DCV for UCC Products OV UCC SSL and OV Wildcard UCC SSL require domain verification for EVERY domain listed on the certificate. If you have 5 domains, you must complete 5 DCV processes. For efficiency, work through them in sequence. The DCV Instructions at the bottom of the page provide general guidance applicable to all domains.

The DCV Instructions panel reads:

- 'A Domain Control Validation or DCV must be completed before issuing an SSL/TLS certificate.'

- 'Please click Verify Domain against each domain name to select a DCV method and prove control over each domain.'

- 'In case of Multi-Domain SSL Certificates, if the authorized domain name (base domain) ownership is proven then all the sub domains that have the same base domain name will be proven automatically. For an example, if xyz.com domain control is proven then the entire sub domains like blog.xyz.com and mail.xyz.com will be proven automatically. Please note that, vice versa is not allowed.'

2.6b DCV Method - DNS TXT Record (Recommended)

Click the 'Verify' button next to a domain. A modal dialog appears.

Technical Note The DCV modal includes a note: 'This is technical in nature. If you are not the right person, please contact your IT / Domain administrator.' If you do not manage your DNS records yourself, forward the TXT record details (Host and Value) to your DNS administrator and ask them to create the record.

Field / Option	What It Is	What To Do
DCV Method dropdown	The method used to prove domain ownership. 'DNS TXT Record (Most Preferred)' is the recommended and pre-selected method.	Leave as 'DNS TXT Record (Most Preferred)' unless your DNS provider does not support TXT records, in which case consult your IT administrator.
Record Type	The type of DNS record to create: TXT.	Always TXT for this method.
Host	The hostname for the DNS TXT record. This is the domain name itself (Copy button available).	Copy this value exactly. Log in to your DNS provider's management panel, navigate to DNS settings for this domain, and use this as the Host/Name field when creating the TXT record.
Value	The unique verification token that must be entered as the TXT record's value (Copy button available).	Copy this token exactly. Enter it as the Value/Content of the new TXT record at your DNS provider. Do not add any extra spaces or characters.
Verify Now button	Triggers the CA's system to check your DNS for the TXT record.	ONLY click Verify Now after you have saved the DNS TXT record at your DNS provider AND allowed sufficient time for DNS propagation (see note below).
Close button	Closes the modal without verifying.	Click Close if you need to set up the DNS record first and return to verify later.

InCommon Note - DNS Propagation After creating the DNS TXT record at your DNS provider, changes may take anywhere from a few minutes to 48 hours to propagate globally (depending on your DNS TTL settings). It is best practice to wait at least 15-30 minutes before clicking 'Verify Now'. If verification fails, wait longer and try again. Do not delete the TXT record until verification succeeds.

2.6c Domain Verification Success

After successful verification, a success popup appears: 'Thank you for proving the domain ownership for [domain]. Domain Verification is completed successfully. Please track your order and complete your pending actions to speed up the certificate issuance process.'

Click OK to dismiss. The domain's status icon turns green. Certificate Status in the right panel updates to 'Approved'.

For UCC and Wildcard UCC products: repeat the Verify process for each remaining domain until all show green / Completed.

2.7 Certificate Issuance

Once all Order Actions (Steps 1-4) are marked Completed, the CA processes and issues the certificate. This typically happens within minutes of the final verification step being approved, but may take up to 1-5 business days depending on CA processing.

Status / Field	Meaning
All Steps 1-4: Completed (green)	All required actions are done - the CA has everything it needs.
Step 5 Certificate Download: Certificate Issued (green)	The certificate has been generated and is ready to download.
Certificate Status: Certificate Generated (green)	Confirmed - your certificate exists and is waiting for you.
Order Status: Order Accepted (orange)	The order is still in the 'Accepted' state; it moves to 'Order Fulfilled' after download.

2.8 Certificate Download

There are three ways to download your issued certificate: via the email notification, via the emSign Subscriber Portal, or directly from CERTInext.

2.8a Download Notification Email

The Organization Representative receives an email with the subject: 'ORDER #[ID] - Your Certificate is ready for download'.

The email contains Order ID, Ordered Date, Product & Validity, and the Identifier (domain). It includes an orange 'Download Certificate' button and an alternative URL to paste into a browser.

Action Click the 'Download Certificate' button in the email. This opens the emSign Subscriber download page.

2.8b emSign Subscriber Portal - Certificate Download Page

The download confirmation page shows:

- A green tick with: 'Thanks for completing the necessary steps.'

- 'Your certificate has been issued and ready for download. To continue further, please click Download Certificate.'

- Order ID, Product & Validity, and Domain Name details.

- Orange 'Download Certificate' button.

2.8c Step 5 - Expanded Download Panel in Order Actions

Expanding Step 5 in the Order Actions list reveals the following download instructions and options:

Step 5 Expanded - Text on Screen Your certificate has been issued and ready for download. An email containing certificate download instructions has been sent to your email ID. In case you have not received an email, please click Resend Email to resend the email. Your certificate is based on the CSR submitted by you. Please ensure to import / use the certificate against the same key-pair, from where the CSR was generated. Please follow the necessary instructions in your download notification email to download your certificate.

Button	Action
Resend Email	Re-sends the download notification email to the Organization Representative's email address. Use this if the original email was not received.
Download Certificate	Initiates the certificate download directly from the portal, bypassing the email.

CRITICAL - Key-Pair Matching Your certificate is generated from the CSR you submitted. You MUST install and use the certificate on the same server and with the same private key that was used to generate the CSR. If you generate a new key pair, you must re-issue the certificate with a new CSR.

2.8d Selecting the Download Format

When initiating a download from CERTInext, a 'Select the Format to download' dialog appears with four options:

Field / Option	What It Is	What To Do
DER encoded binary X.509 (.CER)	Binary format of the certificate. Compact and widely supported by Windows systems and Java keystores.	Choose this for Windows Server (IIS) or Java-based servers. Double-click the downloaded file to view/install in Windows Certificate Manager.
Base-64 encoded X.509 (.CER)	Text-based (PEM) format of the certificate, saved with the .CER extension. Readable in a text editor.	Choose this for most Linux/Unix-based servers (Apache, Nginx), or when your server software requests a .CER file.
Base-64 encoded X.509 (.CRT)	Identical content to the Base-64 .CER above but saved with the .CRT file extension.	Choose this when your server software (e.g., Apache, Nginx) expects a .crt file extension.
Zip	A ZIP archive containing the certificate along with any intermediate/chain certificates. Recommended for most installations.	Choose Zip if you are unsure, or if your server requires the full certificate chain. Extract the ZIP and follow your server's installation guide for the certificate and chain files.

InCommon Note - Which Format to Choose If in doubt, choose Zip - it includes all necessary certificate files (end-entity certificate + intermediate certificates/chain). Your web server administrator will know how to handle the extracted files. For quick Windows inspection, choose DER or Base-64 .CER.

Action Select your preferred format and click Download. Save the file(s) to a secure location. Follow your web server platform's documentation to install the certificate.

2.9 CERTInext Order View - Final State

After the certificate is downloaded, the Order View in CERTInext updates to its final state. Navigate to Certificates - Orders and click your order to view it.

Field	Final Value
Order Status	Order Fulfilled (green)
Certificate Status	Certificate Downloaded (green)
Subscription Status	Active (green)
Subscription Start Date	Date the certificate was issued
Subscription End Date	Expiry date (Start Date + validity period, e.g., 1 year)

2.9a Order Action Menu (- Button)

In the top-right corner of the Order View, a three-dot menu icon (-) provides additional actions depending on the certificate type:

Action	Available For
Download Invoice	All products
Track Order	All products
Download Certificate	All products
Reissue Certificate	All products
Add / Remove SANs	OV UCC SSL and OV Wildcard UCC SSL only
Revoke Certificate	OV UCC SSL only (as shown)

InCommon Note - Reissue vs. Revoke Reissue creates a replacement certificate (useful when you change your server or CSR). The old certificate is revoked as part of reissuance. Revoke permanently deactivates the certificate without replacement - only use Revoke if you are decommissioning the service or the key has been compromised and you will not replace it.