Why OV and EV Validation Fails, and What Fixes It

Why the CA cannot simply read your documents

A validation agent has no discretion to be persuaded. The Baseline Requirements define what may count as evidence, and anything outside that definition is inadmissible however convincing it looks. That is the whole reason a company with filing cabinets full of proof can sit in a validation queue for a week: the proof is real, and none of it is in a form the CA is allowed to use.

One clause does most of the work here. A Reliable Data Source is defined as one "generally recognized among commercial enterprises and governments as reliable, and which was created by a third party for a purpose other than the Applicant obtaining a Certificate". Read that second half again. A document produced because you are applying for a certificate fails by construction. Your letterhead, your invoice, a statement from your own director, a screenshot of your contact page: all excluded, not because the CA doubts them, but because the rule excludes the category.

There is one narrow exception worth knowing, because it saves orders. For the address alone, and not for identity, the CA may accept a utility bill, bank statement, credit card statement or government-issued tax document. Those were created by third parties for entirely unrelated reasons, which is exactly why they qualify. It is a small door, and applicants who know it exists get through the address check without a site visit.

Which of the three checks actually failed?

An OV or EV order passes three organisation checks: legal existence, address, and a verified telephone number. A message saying only that validation failed tells you nothing useful, and the first productive step is to ask the CA or your reseller which check is open. Every remedy below depends on that answer, and sending the wrong evidence usually costs another business day.

The order matters too. The checks run roughly in sequence, so a legal existence problem hides everything downstream of it. Fix the registry mismatch and you may discover the phone check was never reached, let alone passed. Expect to solve them one at a time rather than in a single submission.

Legal existence: the registry has to agree

This check asks whether an organisation with your exact name is registered and active in the jurisdiction you claim. It fails far more often on names than on legitimacy. The CA is matching a string against a government record, so "Northwind Ltd" on the order and "Northwind Trading Limited" in the register is a failure, even though every human involved knows they are the same company.

Order in the registered legal name, in full, with the entity suffix spelled as the registry spells it. Supply the registration number and the jurisdiction alongside it, because that turns a fuzzy name search into an exact lookup. Companies that trade under a brand rather than their legal name should accept that the certificate will carry the legal name, since that is the only name a government registry can confirm.

Recent incorporation is the second common cause. Nothing is wrong with the company; the registry entry simply has not propagated to the sources the CA queries, and the commercial databases that aggregate registries refresh on their own schedule. Waiting works. If the deadline will not wait, the letter route further down is the only path that does not depend on somebody else's refresh cycle.

Two subtler variants catch people out. An entity marked dissolved, struck off, or in liquidation fails the "active and in good standing" part regardless of whether it is still trading. And organisations whose registered name contains characters outside the Latin alphabet run into transliteration mismatches, where the registry, the CA, and the order form each render the name differently. Both are worth checking in the register yourself before you argue with the CA.

The address check and why virtual offices stall

The Baseline Requirements ask the CA to verify that the address is the applicant's address of existence or operation. That phrasing is doing deliberate work: it rules out an address that is merely convenient. A mail-forwarding suite shared by two hundred registered companies is neither where you exist nor where you operate, which is why those orders stall even when the address is genuinely on your company registration.

The simplest fix is agreement. Use the address the registry holds, spelled the way the registry spells it, including the postcode format. A surprising share of address holds are nothing more than a suite number present in one record and absent in the other.

When the registry cannot settle it, this is where the address-only exception earns its keep. A utility bill, bank statement, credit card statement or government-issued tax document in the organisation's name is accepted for the address, and most companies can produce one within the hour. Send a document that shows the company name and the address in the same view, and avoid redacting so heavily that the connection between them disappears.

EV holds the address to a higher standard. The EV Guidelines ask for the place of business, established through qualified government or independent sources, a site visit with photographic evidence, or a professional letter confirming the organisation actually operates there. Note who performs the site visit: the CA or an agent acting for it. Photographs you take yourself of your own office are not that, which is a disappointment applicants discover after the effort.

The phone check: the callback nobody can reach

This one holds up more orders than the other two together, and the reason is structural rather than practical. Under the EV Guidelines a Verified Method of Communication has to be found first in a source the CA already trusts, such as phone company records or a qualified government, tax, or independent information source, and only then called. The number you typed into the order form is the claim under test. It cannot double as the evidence for itself.

That explains the case that feels absurd from the inside: a twenty-year-old business with a working switchboard fails the phone check. The switchboard is fine. The number is simply not published anywhere the CA is permitted to look, because the company's own website does not qualify as an independent source and directory listings quietly lapsed years ago. Numbers on VoIP ranges are especially prone to this, since they often never appear in phone company records at all.

There are two ways out. Get the main number listed in a source that qualifies, which works but takes days to propagate and is rarely fast enough for an order already in flight. Or use a professional letter, which the EV Guidelines accept as a way to confirm a method of communication, sidestepping the directory problem entirely.

Then there is the call itself, which fails for ordinary human reasons. An automated menu with no path to a person. A receptionist who has never heard of the certificate request and declines to confirm anything. A named contact on annual leave. A spam filter on the switchboard. Tell whoever answers the main number that a certificate authority will call about an SSL order, name the person they should transfer to, and give the CA a direct extension where you can. It is unglamorous, and it resolves more holds than any document.

When no qualified source lists you at all

Some organisations are invisible to every database a CA is allowed to query. Newly formed companies, entities in jurisdictions with no online register, partnerships and sole traders, and organisations whose registry record is accurate but thin all end up here. The Baseline Requirements and the EV Guidelines both anticipate this and provide a letter route, with different names and different rigour.

For OV, the instrument is an Attestation Letter: a letter attesting that subject information is correct, written by an accountant, lawyer, government official, or other reliable third party customarily relied upon for such information. The definition is deliberately broad, and CAs usually publish a template. Use theirs.

For EV, the instrument is a Verified Professional Letter, which is either a Verified Legal Opinion or a Verified Accountant Letter, each with content requirements set out in the EV Guidelines. Since Ballot 147 in 2015 the rules around these letters have been tightened and their acceptable scope narrowed, so a letter drafted from an old sample circulating online may not meet the current text.

The step applicants consistently underestimate comes after the letter is written. The CA does not take the letterhead at face value: it obtains the professional's contact details from the body that licenses or registers them, and contacts them there to confirm the letter is genuine. Choose someone whose licence record is current and who will pick up the phone. Include their licence or registration number and the licensing body in the letter. A letter from a hard-to-reach professional converts one stalled check into two.

Used well, this route is fast. It is the standard answer for a company incorporated three weeks ago that cannot wait for database propagation, and it can also confirm an address and a telephone number in the same document, which means one letter can clear several open checks at once.

What EV asks for that OV does not

EV runs the same three checks against a stricter rulebook, plus one requirement OV does not have at all. Legal existence must be confirmed with the incorporating or registration agency itself, through a qualified government information source or direct contact, rather than through any acceptable database. The address becomes a place of business. The contact method becomes a Verified Method of Communication.

The addition is individual identity. For Business Entities, EV requires face-to-face validation of a Principal Individual, which schedules a person rather than requesting a file. There are also role requirements around who may approve the request and who signs the subscriber agreement, which is why EV orders from large organisations often stall in the applicant's own approvals rather than at the CA.

None of this is a reason to avoid EV, but it is a reason to start it earlier than feels necessary. If you are still deciding between the two levels, the practical differences are laid out on the OV certificate page and the EV certificate page, and the vetting effort described here is the part that rarely appears in a comparison table.

Documents that never clear a hold

Applicants under time pressure tend to send more of what they already have, which is almost always the excluded category. Anything your organisation created in order to obtain the certificate is inadmissible by definition, so a second copy of it changes nothing. Knowing the list saves a round trip.

• Company letterhead, or a signed statement from your own director confirming the company exists.
• Invoices or contracts your organisation issued, however many.
• A screenshot of your own website showing the address and phone number. Your site is not an independent source about you.
• Domain WHOIS records. They establish something about the domain, not about the legal entity behind it, and are usually privacy-masked anyway.
• Photographs you took of your own premises. An EV site visit has to be performed by the CA or an agent acting for it.
• A DNS record or a file on your web server. Those satisfy domain control validation, which is a separate check that your order has probably already passed.

The pattern behind the list is the same clause every time: created by a third party, for a purpose other than obtaining this certificate. Test anything you are about to send against that sentence and you will know the answer before the CA replies.

Getting through on the first attempt

Almost every hold described above is avoidable at order time, and the preparation takes about twenty minutes. Look your own company up in the public register and copy the legal name, registration number and address exactly as they appear. Check that the entity status is active. Then search for your main telephone number the way a stranger would, and see whether anything other than your own website returns it.

Nominate a contact who answers their phone during the CA's working hours, in the CA's time zone rather than yours, and warn the switchboard that a call is coming. If your company was registered in the last month or two, or trades from an address no database associates with it, arrange the letter in advance rather than after the first rejection.

One timing point is easy to miss on renewals. Since 15 March 2026 a CA may reuse validated organisation data for 398 days rather than the previous 825, so company details that sailed through two years ago are re-verified far more often now. The 398-day revalidation clock explains how that interacts with shrinking certificate lifetimes. If you want the timings for a clean order rather than a stalled one, the validation timelines by certificate type sets the expectation.

Finally, treat the CA's validation team as a resource rather than an obstacle. They are working from a checklist they cannot deviate from, and they will usually tell you precisely which line is unticked if you ask that question directly. If your order came through a reseller, ask them to relay it. The My-SSL support team can chase a validation query on orders placed here and tell you which document the CA is waiting for.

FAQ