Company certificate
A company certificate names an organisation, not a person, as its holder - the basis for seals, secure websites and business logins.
A company certificate is an X.509 certificate whose subject is a legal person - a company, foundation, government body or other organisation - rather than a natural person. Where a personal certificate identifies an individual, a company certificate binds a key pair to the organisation itself, usually identified by its registered name and a company registration number rather than a person's name.
What the certificate is good for depends entirely on the assurance behind it. The Annexes referenced below sit in the amended eIDAS Regulation - eIDAS 2.0, formally Regulation (EU) 2024/1183, in force since 20 May 2024 - which expanded and updated the qualified trust services framework beyond the original 2014 rules:
- as the basis for a qualified electronic seal: if a qualified trust service provider issues it under eIDAS Annex III, the company certificate becomes a qualified certificate for a qualified electronic seal, letting the organisation seal documents and data in its own name.
- as the basis for website authentication: issued under eIDAS Annex IV, it becomes the certificate behind a qualified website authentication certificate (QWAC), proving which organisation runs a given website.
- for everyday organisational authentication: many company certificates are not qualified at all - they authenticate a server, an API connection or a shared mailbox as belonging to the organisation, at whatever assurance level the issuing certificate authority offers, often marketed as organisation-validated (OV) certificates.
Issuing any of these still starts with the same question a registration authority has to answer: who is authorised to request a certificate on the organisation's behalf. That check typically runs against the business register - an authentic source - and any mandate the applicant holds, the same logic used elsewhere in eIDAS identity proofing.
Note: holding a company certificate is not the same as holding a qualified electronic seal. Only a certificate that meets eIDAS Annex III and is issued by a QTSP creates a qualified seal; a great many company certificates are non-qualified and are meant for internal or business-to-business use, not for the strongest legal effect.