Web PKI (Web Public Key Infrastructure) represents a global trust ecosystem that secures internet communication worldwide. It is built upon strict international standards (CA/Browser Forum), ensuring that certificates issued within this system are automatically recognized and accepted by all modern operating systems and web browsers without requiring any additional configuration on the user's side. It serves as an essential foundation for any services, client zones, and websites accessible to the general public.

The TLS certificates we issue are of theOV (Organization validated) atype and contain only these four mandatory attributes within the certificate Subject: CN (CommonName), indicates the name of the component or device. The fully qualified domain name (FQDN) of the component must be used as the CN (e.g., CN=www.disig.sk), O (Organization), indicates the name of the legal entity or natural person who has control over the FQDN specified in the CN attribute, or over the FQDNs listed in the SAN (Subject Alternative Name) extension., L (Locality), indicates the municipality where the legal entity or natural person specified in the O attribute is registered/resides. and C (countryName), two-letter country code (e.g., SK for the Slovak Republic) where the respective legal entity or natural person is registered/resides.
A prerequisite for issuance is demonstrating that the relevant domain belongs to the entity applying for the TLS certificate.

The applicant for a Web PKI certificate (hereinafter referred to as "TLS certificate") may be:

1. Legal person
2. Natural person

Applicant identification

The applicant for this type of certificate shall submit:

Legal person

• Identity Card - Statutory Representative or Plenipotentiary;
• Power of attorney - submitted in case the statutory body of the certificate holder cannot personally visit the RA branch and had authorized another person to take over the certificate. Only the power of attorney verified by a notary is accepted;
• Original or officially certified copy of the extract from the trade register not older than three months (to be consulted);
• An officially certified copy or photocopy of the extract from the trade register (remains on RA Disig).

Natural person

• Identity Card - Statutory Representative or Plenipotentiary
  1. Citizen of the Slovak Republic - valid identity card
  2. EU citizen - identity card
  3. Third-country national - residence permit on the territory of the Slovak Republic and another document with a photo confirming his / her identity
• Power of attorney - submitted in case the statutory body of the certificate holder cannot personally visit the RA branch and had authorized another person to take over the certificate. Only the power of attorney verified by a notary is accepted!

Create a request to issue a TLS certificate

A TLS certificate is issued based on an electronic request in PKCS#10 or SPKAC format, which the applicant generates on their own system resources.

The process of issuing a TLS certificate

TLS certificate can only be issued at the head office of Disig, a.s. The applicant shall send the certificate request by e-mail to radisig@disig. The RA employee checks the formal correctness of the certificate request and verifies the control over all the domains in request as well as other data according to internal regulations. After completing all the necessary verifications he/she shall agree on a date for the meeting with the applicant. At a face-to-face meeting, the RA staff member verifies the compliance of the data in the application with the data in the submitted documents. After verifying the identity of the applicant for the certificate, the RA worker will forward the request to the CA for processing. The process of issuing the TLS certificate is completed by signing the appropriate documentation. At the client's request, the RA worker saves the issued TLS certificate on the device brought by the client. The issuing process takes about 20 minutes.

TLS certificate validity

A TLS certificate is valid at the time of issuance. A TLS certificate is issued:

• to 14.3.2027 with maximum validity 200 days,
• from 15.3.2027 to 14.3.2029 with maximum validity 100 days and
• rom 15.3.2029 with maximum validity 47 days.

After this period the TLS certificate expires automatically and can no longer be used for the purpose for which it was issued. A TLS certificate that has expired or has been revoked cannot be renewed. For renewal, the applicant must proceed with the entire process of requesting and verifying identity as in issuing the original TLS certificate.

Conditions for revoking a TLS certificate

In case the TLS certificate must be revoked for one of the following reasons:

• keyCompromise (RFC 5280 CRLReason #1),
• privilegeWithdrawn (RFC 5280 CRLReason #9),
• cessationOfOperation (RFC 5280 CRLReason #5),
• affiliationChanged (RFC 5280 CRLReason #3) alebo
• superseded (RFC 5280 CRLReason #4,

he provider must make available to the end user more detailed information about the above-mentioned options together with an explanation of when to choose individual options when requesting certificate revocation and how to proceed in relation to the provider. Detailed information is available here - TLS certificate revocation conditions.

Automated TLS Certificate Issuance via ACME Protocol

Our company offers the possibility of automated issuance of TLS certificates via the ACME (Automated Certificate Management Environment) protocol. More about ACME can be found at - Automatic issuance of TLS certificates via ACME protocol.
General terms and conditions for the provision of automated TLS certificate issuance services (ACME) - VOP ACME

Price for issuing a TLS certificate.

In accordance with CA Browser Forum requirements in section 2.2 of the current version of the document "Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates" the certification authority is required to provide a website that allows application vendors to test their software using issued TLS certificates that are linked to trusted CA Disig root certificates. In a minimal configuration, must be available pages with the valid, revoked and expired TLS certificates.