Organization Authentication is Step 2 in the Extended Validation (EV) SSL certificate process. An EV certificate is the highest assurance level a public certificate authority issues, and before it can be signed the CA has to confirm two separate things: that your organisation is a real, legally registered entity, and that you control the domain the certificate will secure. This step covers the first of those checks. To complete it, download and follow the official worksheet: Organization Authentication (EV) PDF.
What Organization Authentication actually verifies
Where a Domain Validated (DV) certificate only proves you control a domain, and an Organisation Validated (OV) certificate adds a light check of the company behind it, EV goes further. The certificate authority independently confirms that your business exists in official government or registry records, that its legal name and registered address match what you have submitted, and that the person requesting the certificate is authorised to do so on the organisation's behalf. Passing this stage is what allows the CA to include your verified legal identity inside the certificate itself.
DV domain control only OV domain + light org check EV domain + full legal identity Step 2 lives here Rising assuranceWhat you will typically need to hand
The exact requirements are set out in the PDF worksheet above, but organisation authentication usually asks you to confirm details such as:
- Your organisation's exact registered legal name, as it appears in official records.
- The registered business or trading address and a working telephone number.
- Proof of legal existence, for example a company registration or incorporation number that the CA can verify against a government or third-party registry.
- Confirmation that the person applying is employed by, or authorised to act for, the organisation.
Because the certificate authority checks these against independent sources, the fastest way through this step is to make sure the details you submit match your official records character for character. A trading name that differs from the registered name, or an address that has moved since your registration was filed, is the most common reason EV vetting stalls.
Where this step sits in the wider process
Organisation Authentication is one part of a multi-step EV order. A later stage, Domain Authentication, confirms your control of the domain name itself, and the certificate is only issued once every stage clears. If you are working through the whole sequence, the full set of guides is collected in our SSL certificates FAQ, and you can review the products and validation tiers on the SSL certificates page.
Is EV worth it?
Be realistic about what EV does. Modern browsers no longer show a distinct green company name in the address bar the way they once did, so the old visual selling point has largely gone. What EV still gives you is the strongest documented proof of legal identity inside the certificate, which can matter for banking, high-value ecommerce, government suppliers, or any organisation that needs to demonstrate rigorous vetting for compliance or contractual reasons. For most standard websites, DV or OV is sufficient. EV is a deliberate choice for organisations that need the paperwork trail, not a search ranking or performance upgrade. Whichever tier you pick, the encryption strength on the wire is the same, and you should still follow current server-side TLS best practice when you deploy the certificate, such as the settings recommended by Mozilla's SSL Configuration Generator.
If any field on the worksheet is unclear, or your registry details do not line up with what the CA is asking for, contact our support team before you submit so we can help you avoid a rejected order and a fresh round of vetting.
