OV vs EV Code Signing: How Long Does Certificate Issuance Take?

Getting a code signing certificate is not instantaneous the way downloading a software license is. The core of the process is identity verification by the Certificate Authority, and identity verification takes time because it involves checking your organization against independent databases and confirming that someone at your organization authorized the request. How much time depends on whether you are ordering OV or EV, how well-established your organization is in public databases, and whether you choose cloud delivery or a physical token.

This guide gives realistic timelines for every stage of both OV and EV issuance, explains what causes delays at each stage, and identifies what you can do before ordering to reach the fastest possible timeline.

Timeline Summary: OV vs EV at a Glance

These timelines reflect the validation period only for cloud delivery. Physical token delivery adds shipping time on top of validation. The validation stage and delivery stage are sequential: shipping begins after validation completes and the certificate is issued.

OV Certificate: Every Stage of the Timeline

Stage 1: Order submission (minutes)

You complete the order form, provide your organization details, and submit payment. The CA’s system acknowledges the order and queues it for the validation team. This stage is instant. There is no meaningful wait here unless the CA’s portal has technical issues.

Stage 2: Automated database check (hours)

Most major CAs run automated checks against their QIIS databases immediately after receiving an order. The system searches for your organization name, registered address, and ideally a phone number in sources like Dun and Bradstreet, government business registries, and commercial directories. For well-established organizations with consistent public records, this step completes automatically within hours and creates no action item for you.

If the automated check returns insufficient or conflicting results, the order is flagged for manual review, which extends the timeline. This is where new or small organizations most commonly see their first delay.

Stage 3: Phone number verification (the key variable)

This is the stage that most commonly determines whether OV validation takes 1 day or 5 days. The CA must verify a phone number for your organization through an independent source, not just the number you provide on the order form. If your organization’s phone number appears in a QIIS database, the CA calls that number, someone answers, and validation can complete the same day. If your phone number does not appear in any QIIS, the CA’s validation team has to request alternative evidence.

The CA then calls the verified number during business hours. Someone at your organization must answer and confirm the certificate request. This call is typically brief : under 5 minutes : but scheduling it requires that someone is available when the CA calls. If the first call is missed, the CA may leave a message or try again, adding at least a day to the timeline for each missed attempt.

The phone verification stage is where most OV orders stall beyond the typical timeline. If your organization uses only a mobile number, a VoIP number, or a number not listed in any business directory, the CA cannot complete this step from a database lookup alone. Resolve this before ordering: add your number to Google Business Profile or a similar business directory and wait several days for it to propagate, or contact your CA to ask what they accept in place of a QIIS listing.

Stage 4: Certificate issuance (minutes)

Once the validation team approves all three required elements (legal existence, address, phone), the certificate is issued within minutes. This stage adds no meaningful time to the process.

Stage 5: Delivery

• Cloud HSM delivery: the certificate is immediately accessible through the cloud signing service. You receive enrollment instructions by email, set up credentials, and can sign within hours of issuance.
• Physical USB token delivery: the CA ships the token after issuance. Domestic shipping (US, UK, most of Europe) typically takes 5 to 15 business days. International shipping varies from 10 business days to 30 or more depending on destination and customs delays.

EV Certificate: What Takes Longer and Why

EV validation includes all the same steps as OV plus additional verification requirements mandated by the CA/B Forum Code Signing Baseline Requirements. These additional steps consistently add 2 to 7 business days to the OV timeline and occasionally more if the additional steps encounter complications.

Additional Step: Organizational authority verification

For EV, the CA must confirm that the person requesting the certificate is authorized to act on behalf of the organization. This is not required for OV, where the validation focuses on the organization rather than who at the organization placed the order.

The CA verifies authority through one of several means: a callback to a named officer (director, officer, or authorized agent) at the organization’s verified phone number, confirmation via the organization’s government filing showing the requester as an officer, a legal opinion letter from an attorney attesting to the requester’s authority, or similar evidence. The CA chooses the method based on what the organization’s available documentation supports.

The officer callback is the most common method and the most variable in timing. The CA needs to reach a specific named person : not just anyone at the organization : at the verified organizational phone number. If the named officer is unavailable, traveling, or doesn’t answer, the callback must be rescheduled. In practice, this step alone can add 2 to 5 business days.

Additional Step: Stricter legal existence verification

EV requires verification of the organization’s legal existence at a higher standard than OV. The certificate must include the organization’s full legal name exactly as it appears in official filings, the business category (private organization, government entity, or business entity), and the jurisdiction of incorporation. The CA verifies each of these from authoritative sources. Discrepancies between the order form and official records require correction before issuance can proceed.

Why EV takes longer even with perfect documentation

Even when an organization’s documentation is complete and consistent, EV validation involves more manual review steps than OV. The CA’s validation team processes OV orders partly through automated database lookups; EV orders require more individual case review. At major CAs, EV order queues are typically handled by senior validation staff with fewer automated shortcuts. The result is that even a ‘best case’ EV timeline is 3 to 5 business days rather than OV’s 1 to 2 days.

Common Causes of Delays and How to Avoid Them

What Consistently Speeds Up Validation

Dun and Bradstreet DUNS number

A D&B DUNS number linked to accurate company information is the single most effective preparation step for fast OV and EV validation. D&B is a primary QIIS for most major CAs. When D&B shows your organization’s legal name, address, and a verified phone number, the CA’s automated checks can confirm all three required OV elements from a single source. Organizations with a current D&B listing frequently complete OV validation within 24 hours. Obtaining a free DUNS number takes a few weeks to propagate, so this preparation is most useful if you are planning ahead rather than ordering urgently.

Google Business Profile with verified phone

Google Business Profile with a verified phone number is accepted by many CAs as a phone verification source. Google’s business verification process (postcard, video call, or other methods) provides independent confirmation of your business’s phone number and address. This option is faster to establish than a D&B listing for businesses that don’t already have D&B presence. Verification typically completes within a few days.

Cloud delivery over physical token

Choosing cloud HSM delivery removes the shipping stage from the timeline entirely. For organizations with a fixed release date or an urgent signing need, cloud delivery reduces the total time from order to first signature by 1 to 3 weeks compared to physical token delivery. The validation timeline is identical regardless of delivery method; only the post-validation stage differs.

Preparing documentation before ordering

If your organization is newer, operates from a home address, or has limited public registry presence, prepare your documentation before placing the order. Have your certificate of incorporation or registration document, a recent utility bill or bank statement at the registered address, and information about any D&B listing ready. A CA that receives a complete documentation package on first contact moves faster than one that has to wait for responses to document requests.

Microsoft Trusted Signing: The Fastest Path for Eligible Organizations

Microsoft Trusted Signing, available through the Azure portal at approximately $10 per month, has a validation process that is typically faster than traditional OV for eligible organizations. US and Canada-based organizations with at least 3 years of verifiable operating history that already have an Azure account can sometimes complete onboarding within a few hours.

The faster timeline reflects Microsoft’s validation approach for this service, which draws on Azure account history and organizational verification methods that may be faster than traditional CA phone-based validation for organizations with strong Azure presence. It is not always faster : organizations without a strong Azure or Microsoft ecosystem history may go through a more involved review. But for organizations that qualify, it represents the fastest available path from order to first signature.

Planning Your Timeline: Practical Guidance

• If you need to sign in less than 48 hours: only Microsoft Trusted Signing (if eligible) or a cloud HSM service where you already have an account can realistically meet this timeline. New certificate orders from traditional CAs cannot complete validation in less than 1 business day in most cases. Contact the CA directly if you have an urgent need; some offer expedited validation for an additional fee.
• If you have 3 to 5 business days: OV with cloud delivery is realistic if your organization has a verifiable phone number in a business directory. Order at the start of the business week, be available for the validation callback, and respond promptly to any communications from the CA’s validation team.
• If you need EV: plan for 2 weeks minimum, with 3 to 4 weeks as a safer planning horizon. Ensure the officer who will take the verification callback is available and their contact details are consistent with your organization’s records. EV is required only for kernel-mode driver signing and WHQL; for standard software distribution, OV is appropriate.
• If you are ordering a physical token: add 2 to 3 weeks for domestic shipping and 4 to 6 weeks for international shipping to whatever your validation timeline is. Order at least 6 weeks before your release date for domestic, and 8 to 10 weeks for international.

Frequently Asked Questions

Does the CA validate on weekends?

Most major CAs do not process validation requests on weekends or public holidays. Orders placed Friday afternoon or over the weekend enter the queue when the validation team returns Monday. If you are working against a specific deadline, placing the order Monday or Tuesday morning gives you the best chance of completing validation within the week.

Can I track where my validation is in the process?

Most CAs provide a portal where you can view the status of your order. The status typically shows which validation steps have been completed and which are pending. If the order status has not moved in more than 2 business days, contact the CA’s validation support team directly. Proactively checking in sometimes surfaces a communication that was filtered to spam or a callback that was missed.

My validation was approved but I haven’t received the token yet. Is that normal?

Yes. Validation and shipping are sequential stages. The certificate is issued after validation completes, and then the token is enrolled with the certificate and shipped. The shipping process itself (packaging, carrier pickup, transit) begins after issuance. The total time between validation approval and token delivery is the sum of the issuance time (usually the same day or next business day) plus the shipping transit time. Tracking information is typically provided by email once the shipment is created.

Gloria Bradford

Gloria Bradford is a renowned expert in the field of encryption, widely recognized for her pioneering work in safeguarding digital information and communication. With a career spanning over two decades, she has played a pivotal role in shaping the landscape of cybersecurity and data protection.

Throughout her illustrious career, Gloria has occupied key roles in both private industry and government agencies. Her expertise has been instrumental in developing state-of-the-art encryption and code signing technologies that have fortified digital fortresses against the relentless tide of cyber threats.