Sectigo® CaaS OV Single Site Information

Sectigo® CaaS OV Single Site is a single-domain SSL Certificate delivered through Trustico® Certificate as a Service (CaaS) that adds a verified organization identity through Organization Validation (OV). It is issued and reissued automatically through the Automatic Certificate Management Environment (ACME) protocol, the same as any other CaaS SSL Certificate, while recording your checked organization details inside the SSL Certificate.

It suits teams that manage SSL Certificates programmatically, through continuous integration and deployment (CI/CD) pipelines or infrastructure as code, and that also want a checked business identity on a customer-facing site. You get the automation of Certificate as a Service (CaaS) together with the assurance of Organization Validation (OV).

When you order, you provide your domain without the www prefix, and Trustico® adds the www version as an additional name at no charge. Ordering yourdomain.com therefore covers both yourdomain.com and www.yourdomain.com, so your ACME client can request either name. Learn About Domain Names Secured Free 🔗

Verified Organization Validation (OV) 🔗	Secures Domain + www Free of Charge 🔗
USD $1,000,000 Relying Party Warranty 🔗	2048-bit Industry Standard SSL Certificate
Requires a Pre-Validation Reference 🔗	Automated Domain Control Validation (DCV) 🔗
Programmatic Management	Includes Hosted Issuance Tool 🔗
Includes Sectigo® Site Seal 🔗	Unlimited Server Licenses
Automated Installation	Unlimited Reissue Policy 🔗
99.9% Web Browser Ubiquity 🔗	Extend the License Without Reinstallation

The sections below explain how Sectigo® CaaS OV Single Site is validated, how the automation works, and how to put it in place.

Sectigo® as a Trusted Certificate Authority (CA)

Sectigo® is a long-established, widely trusted commercial Certificate Authority (CA), with root Certificates present in virtually every browser, operating system, and device. An SSL Certificate issued under the Sectigo® roots is recognized straight away, with no extra configuration or trust store updates.

Choosing Sectigo® CaaS OV Single Site gives you that established trust together with a verified organization identity and automated delivery through the Trustico® platform. Learn About the Sectigo® Certificate Authority (CA) 🔗

Get Pre-Validated Before You Start

Before you order Sectigo® CaaS OV Single Site, you need a pre-validation reference, as the order cannot be submitted without one. The reference confirms that your organization has already been validated, so the organization checks are completed in advance rather than during each order. Learn About Getting Pre-Validated 🔗

A pre-validation reference stays valid for 398 days from activation and is reused across eligible orders in that time, which removes the repeated organization checks. It is tied to the brand range, so a Sectigo® reference is used with Sectigo® products. Trustico® handles the pre-validation, and you enter the reference on the order form.

Verified Organization Identity

With Domain Validation (DV), an SSL Certificate confirms only control of the domain. Organization Validation (OV) records your checked company details inside the SSL Certificate, where anyone can view them by inspecting it, which matters most where sensitive data or payments are handled. Learn About Organization Validation (OV) 🔗

The Case for Certificate as a Service (CaaS)

Traditional SSL Certificate management involves manual steps at every stage : generating a Certificate Signing Request (CSR), completing validation, downloading files, and installing them on each server. Certificate as a Service (CaaS) replaces those steps with automation that handles ordering, issuance, and reissue for you.

When you order Sectigo® CaaS OV Single Site, you are buying an SSL Certificate license for a set period. Throughout that period your ACME client reissues the SSL Certificate as it approaches expiry, so the domain stays protected for the term with no manual work. Explore Certificate as a Service (CaaS) 🔗

When the license period nears its end, you can extend it without any reinstallation or reconfiguration. The extended validity is recognized automatically, with no need to generate new External Account Binding (EAB) credentials or change your server. Learn About License Extensions 🔗

The Automated SSL Certificate Lifecycle

Sectigo® CaaS OV Single Site uses the Automatic Certificate Management Environment (ACME) protocol to handle the SSL Certificate lifecycle. Your server runs an ACME client that talks to the Certificate Authority (CA), managing domain control, issuance, and reissue without manual steps.

You install an ACME client and authenticate it once using External Account Binding (EAB) credentials from your Trustico® account. With your organization already covered by the pre-validation reference, the client proves control of the domain, the SSL Certificate is issued, and it is reissued before each expiry. Explore ACME Protocol Details 🔗

Domain Control Validation (DCV)

Pre-validation covers your organization, not your domain. Domain Control Validation (DCV) is a separate step that proves you control the domain names, and it is completed automatically on each order and on most reissues, even where a pre-validation reference is in place.

Your ACME client answers the challenge for you. An HTTP-01 challenge places a verification file on your web server, while a Domain Name System (DNS) challenge creates a temporary Domain Name System (DNS) TXT record, which suits servers that are not publicly reachable on port 80. Learn About The Validation Procedure 🔗

Supported ACME Clients and Server Environments

Sectigo® CaaS OV Single Site works with the major ACME clients, so you can use the tool that fits your setup. Certbot is common on Linux with Apache or Nginx, while win-acme and Certify The Web give native support on Windows and Microsoft Internet Information Services (IIS).

For containers, cert-manager integrates with Kubernetes, and acme.sh is a lightweight shell option. Further clients such as lego, dehydrated, and Posh-ACME cover Go, shell, and PowerShell environments, across the major web servers, control panels, and cloud platforms. Find Out More About Supported ACME Clients 🔗

Your Certificate as a Service (CaaS) license allows unlimited SSL Certificate issuance for its domain names, and the same External Account Binding (EAB) credentials drive an ACME client, the cPanel Plugin, and the hosted issuance tool alike. More than one method can be in use at the same time.

External Account Binding (EAB) Credentials

External Account Binding (EAB) links your ACME client to the Certificate Authority (CA). Trustico® creates a Key Identifier and an HMAC Key and sends them to you after purchase, and they are also available in your ordering account for a limited time. You provide them when you first set up the client.

Each set of External Account Binding (EAB) credentials can be managed separately, so you can hold different bindings for different servers, environments, or pipelines. View Our External Account Binding (EAB) Credential Setup Guide 🔗

Encryption and Protocols

Sectigo® CaaS OV Single Site uses a 2048-bit RSA key with 256-bit symmetric encryption, over the Transport Layer Security (TLS) 1.2 and 1.3 protocols with SHA-256 hashing. Elliptic Curve Cryptography (ECC) keys are also supported for environments that benefit from smaller keys and faster handshakes. Compare Encryption Standards 🔗

Preparing for Shorter Validity Periods

Industry rules are reducing the maximum validity of an individual SSL Certificate in stages, to 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. SSL Certificates will therefore need replacing far more often than the annual cycle most teams are used to.

Certificate as a Service (CaaS) handles each reissue automatically, so the change in validity makes little difference to you. Your pre-validation reference keeps the organization stage ready, and the automation takes care of domain control and installation. Explore Traditional and CaaS Compared 🔗

USD $1,000,000 Warranty

Every Sectigo® CaaS OV Single Site SSL Certificate carries a USD $1,000,000 Relying Party Warranty, which provides financial cover in the unlikely event that the Certificate Authority (CA) issues the SSL Certificate in error. Reissues are unlimited across the license through the automation. Review Warranty Details 🔗

Sectigo® Site Seal

Your order includes a Sectigo® site seal that you can display on the secured site to reassure visitors. It works well on payment, sign-up, and contact pages. Explore Trust Seals 🔗

Browser Compatibility

Sectigo® CaaS OV Single Site is trusted by around 99.9% of web browsers, including Chrome, Firefox, Safari, and Edge. Mobile devices on iOS and Android trust the domain without any additional configuration. Understand Browser Compatibility 🔗

Unlimited Server Licenses

You can install Sectigo® CaaS OV Single Site on as many servers as you need at no extra cost, which suits cloud-native setups that use load balancing, redundancy, containers, and distributed systems. The same SSL Certificate and key are deployed to each server that serves the domain.

Your SSL Certificate License

Your purchase is an SSL Certificate license for the term you choose, and a multiple year license fixes the current pricing for the whole term. Because an individual SSL Certificate has a maximum validity set by industry rules, the license is kept current by reissuing the SSL Certificate during the term.

Reissues are free and unlimited across the license, and the automation handles them for you. While your pre-validation reference is valid, the organization stage is reused, and domain control is confirmed on each reissue as normal. Manage your license in the Trustico® Tracking System 🔗

Who Should Use Sectigo® CaaS OV Single Site

It fits teams that provision single-domain SSL Certificates through automated pipelines and also need a verified organization identity, such as financial, healthcare, professional, and business-to-business organizations securing customer portals, account areas, and payment pages.

Managed service providers, e-commerce platforms, and hosting platforms that issue SSL Certificates for their own or client domains can apply it consistently through configuration management tools such as Ansible, Terraform, and Puppet.

Other Options

If you do not need a verified organization identity, the Domain Validation (DV) version of this product secures the same domain through the same automation, with domain checks only. Compare Sectigo® CaaS DV Single Site 🔗