What Happens After You Purchase a Code Signing / EV Code Signing Certificate

A summary is given before we look at each step in detail. Just as with SSL, our team will handle your enrolment and any coordination with the Certificate Authority all the way through — you'll not need to log in to any third-party certificate console.

1. Send your order and company details.
2. We will enter your order and send your organisation in for validation.
3. Validation team will do call verification with point of contact person.
4. We will load your certificate onto your signing token.
5. Start signing code.

The descriptions that follow explain what is involved in each step and the things you will need to provide at various stages.

A Code Signing certificate is not linked to a domain, which means that no DNS, CNAME, TXT, or file-based domain verification is required (unlike with SSL). Instead, the verification process confirms the organisation's identity by checking it against various listings such as MCA, JustDial, Google Business, and Dun & Bradstreet and also verifies the authority of the person who placed the order by making a call to the telephone number on file for the POC associated with the order.

Step 1: Submit Your Order

To log in to your HTTPS.In the account, click 'Process Order'; you will need to provide a CSR along with your organisation details. This is the only step which requires you to take action before validation starts.

Step 2: We Enrol Your Order

We will have the Certificate Authority validate your order and organisation on your behalf.

Step 3: Complete Organisation & Identity Validation

1. Check that your organisation is legally registered: make sure you have basic proof of business registration—for example, an incorporation certificate, a GST business licence, or a telephone bill from the last three months—so that the Certificate Authority can verify your company is both legally registered and in good standing. The name of the organisation as it appears in your order must exactly match the name in your official registration records.
   
   
2. Checking that your physical address is valid: The Certificate Authority will independently verify that your organisation actually has a physical presence at the address you have given, checking this information against government records, JustDial, Google Business listings, or other established business directories.
   
   
3. Full Phone (Authority) Verification: The Certificate Authority will call the verified number that is publicly listed for your organisation—usually between 8 and 12 hours after the request has been submitted—in order to verify that the person making the request is authorised to order a certificate on the organisation's behalf. This number/email is obtained from sources such as the MCA (Ministry of Corporate Affairs), JustDial, Google Business, and Dun & Bradstreet; we will give it to you in advance so that you can check it is both active and reachable. As for how you can speed up the process:
   
   
   1. Make sure that the point of contact for your organisation, is informed that a verification call is expected and that the caller will expressly request the POC who is listed on your order. If the POC is not available, then the receptionist should provide their direct number to validation team or transfer the call to them.
      
      
   2. If nobody answers the call directly, a verification code will be sent to the email address which has been verified or listed (MCA) for your organisation. A point of contact from your organisation will then have to call back — this would be an international number — and give the code. The email from the Certificate Authority contains full instructions.
      
      
4. Get Verified Contact Approval: After you have submitted your order, the Verified Contact who has been designated by your organisation will receive an approval email directly from the Certificate Authority. This approval is required—the certificate will not be issued until it has been completed.

Check Your Validation Status

You can log into your HTTPS.IN account and then select My Orders to check the status at any time, or else get in touch with our support team; we will also send you an email proactively at each stage—when validation is in progress, when approval is pending, and when it has been issued.

Step 4: We Provision Your Signing Token

By industry requirements, both code signing and EV code signing private keys must be generated and stored on certified secure hardware – we look after this for you, so you won't have to carry out any technical configuration.

When the Certificate Authority has issued your certificate, a new token will be sent to the address you have confirmed, or an existing token will be updated remotely. In either case, you will end up with a signing token that is ready to use.

Note: If your address is outside India, DigiCert will be responsible for delivering the token; we will do so only when the delivery address is in India at present.

Step 5: Sign Your Code

When your token has been set up, you can proceed to sign the code. It is important that you always add a timestamp to the signed code since timestamping is what ensures the code is signed. The certificate will remain trustworthy even after it has expired, meaning that you'll only need to obtain a new certificate when you are producing new code or modifying existing code. With your certificate, we also provide the URLs of the timestamp servers.

As of February 24, 2026, the maximum validity for publicly trusted Code Signing and EV Code Signing certificates is 459 days (industry-wide change — no more 2- or 3-year code signing certificates).