Knowledge Base

An anchor certificate will pre-validate domains for future EV certificate requests.  All domains that require an EV certificate should be included in this request.  If a domain is not listed in this request, you can still request an EV certificate; however, the order will need to be processed manually by Sectigo Validation.

There are no prerequisites to create an EV anchor certificate, yet we suggest every organization follow the steps and note's below.

note:  there is only one EV anchor certificate that can be applied to each organization.  If you currently have an EV anchor in place, we suggest you call the validation team before starting this process so they can remove the current anchor in place.

This procedure does not change our current certificate ordering process but is simply here to help make EV processing more efficient.

note:  The EV Anchor is NOT an actual certificate that can be used.
note:  Do NOT change the Organization EV details within SCM after you have validated and issued an EV Anchor certificate. Changing validated details of an organization creates a mismatch between the certificate request and the existing EV anchor. This condition requires a manual re-validation of the organization by the Sectigo Validation Team and will delay the issuance of certificates until that re-validation has been completed.

note:  Requesting a new EV anchor (for adding domains).  Please contact Sectigo Support so we can ensure the (old) anchor is revoked properly, as well as eliminate the possibility of a certificate request copying incorrect EV details from the (old) anchor.


1.    Login to SCM Dashboard and ensure your Organizations EV Details are populated


2.    From the SCM menu bar, Click Organizations

 

3.    Select the Organization Name and Click Edit 


4.    Now, in the Edit Organization section, Click EV Details and populate the following fields.  Click OK when complete.


5.    To Request an EV Anchor certificate, in the left navigation, expand the Certificates option and click SSL Certificates


6.    Click the Add + button to Add a new Certificate request


7.    Select Option “Using a Certificate Singing request (CSR)” and click NEXT 


8.    Enter the following information:

• Select the corresponding Organization
• Department = NONE
• Certificate Profile = EV Anchor Certificate*
• Certificate Term = 1 Year 1 Month
• Click Next

9.    Upload (or Copy and Paste) your CSR.  Select the Key Type, click Next
note:  a CSR is generated using your Web Server Softeware


10.    Common Name and Subject Alternative Names (SAN)

• Enter the Common Name (this can be any domain you need an EV certificate for)
• In the SAN:  enter all domains that you will need the EV Anchor to secure

note:   If the certificate profile EV Anchor Certificate is not available, please contact Sectigo Support or your account manager and they can add this product to your available certificate profiles.


note regarding domains:

• Do Not include sub-domains in this certificate unless you are only authorized to order EV certificates for a particular sub-domain.
• Requirements for EV Enterprise RA (created by the CA/B Forum) allow unfettered issuance only of certificates at 3rd and higher domain levels from a fully validated, active EV SSL certificate. 
• example: Including example.com will allow you to obtain EV certs for sub1.example.com, sub2.example.com or sub1.sub2.sub3.example.com, BUT including www.example.com will only allow sub1.www.example.com, etc.
• Do Not include any wildcards, only root domains.

11.    Verify the EV details, click Next


12.    The auto-renewal step is optional and can be edited in the certificate details later.


13.    Proceed to Subscriber and Certification agreement, click I agree 

• Once the request is submitted, another MRAO Admin must approve and finalize the request. 
• Once the request is approved, you will receive the order number.

14.    Setting the Anchor in SCM
To accelerate the turnaround time for this anchor certificate

• Submit a Support ticket at https://sectigo.com/support-ticket. 
• Have your order number on-hand. 
• Use the description field to request an EV anchor certificate be set for your account.

note:  the validation team may request additional information to verify ownership and company identity. Turnaround time for this request is dependent upon completion of this paperwork.

The EV anchor will be valid for approximately 13 months.  DCV expiration notifications will be sent out for this certificate just like any other certificate from SCM.

To locate the order number in your SCM Dashboard, go to:

• Certificates >>
• SSL Certificates >>
• Filter (to locate the certificate applied for by the common name) >>
• Select Details >>
• Under certificate details you will see the order number

You can renew this certificate or order a new one within SCM. However, the validation team is to be contacted with the new order number (a renewal will generate a new order number) and request to make it an anchor certificate.

note: 

• The primary organizational details will be set to match the details validated in the anchor cert order.
• IF those details are changed it will require a new anchor certificate to be created and validated.
• The departments under the primary organization must NOT have different details (except for the Department Name).
• The street address, city, state, postal code, and country will become un-editable.

For additional questions / concerns, please contact Sectigo Validation