---
title: "Sign a certificate with GlobalSign"
slug: "how-to-sign-a-certificate-with-globalsign"
updated: 2026-11-06T14:00:23Z
published: 2026-11-06T14:00:23Z
canonical: "docs.senhasegura.io/how-to-sign-a-certificate-with-globalsign"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign a certificate with GlobalSign

This document provides information on how to sign an **OV** or **EV** certificate with GlobalSign in the Segura® Platform, using GlobalSign's **Managed SSL (MSSL)** API, from the creation of the certificate authority until the revocation of the certificate.

Info

MSSL issues OV and EV certificates only. DV requests through an MSSL CA are rejected.

## Requirements

- A GlobalSign account enrolled in **Managed SSL (MSSL)**, with an MSSL profile.
- An organization with a phone number and a complete address. For EV certificates, the organization also needs a trade name, a business category, and a CNPJ.
- Optional: the domains to be certified already validated in your MSSL profile. This is the fastest path. Otherwise, Segura® adds the domain to the profile and the request waits for domain validation. See [Validate the domain](/v4-2/docs/how-to-sign-a-certificate-with-globalsign#validate-the-domain).

## Create a certificate authority in the Segura® Platform

For information on how to create a GlobalSign CA in the Segura® Platform, see [How to integrate with a GlobalSign CA](/v4-2/docs/clm-integrate-globalsign-ca).

In the **Type *** field, select **Managed MSSL**. Without it, the MSSL flow does not run.

## Create an organization in the Segura® Platform

For information on how to create an organization in the Segura® Platform, see [How to configure organizations](/v4-2/docs/certificate-manager-settings-how-to-organizations).

Fill in the organization's phone number and complete address. For EV certificates, also fill in the trade name, business category, and CNPJ.

## Generate a Certificate Signing Request (CSR)

1. On **Segura® Platform**, in the navigation bar, hover over the **Products menu** and select **Certificate Manager**.
2. In the side menu, select **Requests > SSL/TLS**.
3. In the top right corner, click **Add**.
4. Enter the following certificate information:
  1. **Certificate type ***: Select **OV SSL - Organization SSL**, or the EV option for an EV certificate.
  2. **Domain type ***.
  3. **Organizations ***: Select the organization created previously.
  4. **Common name ***: Enter the domain to be protected by the certificate. (For example: `www.yourdomain.com`).
  5. **Expiration (in days) ***. GlobalSign MSSL orders always have a 12-month validity, regardless of this value.
  6. **Encryption algorithm ***: Choose between **RSA** and **DSA**.
  7. **Encryption key size ***: Choose between **4096**, **2048**, and **1024**.
  8. **Certificate signature algorithm ***: Choose between **SHA256**, **SHA384**, and **SHA512**.
  9. **Additional configuration**: Select the option to use the previously created CA.
5. Save all configurations.

## Sign a CSR

1. On **Segura® Platform**, in the navigation bar, hover over the **Products menu** and select **Certificate Manager**.
2. In the side menu, select **Requests > SSL/TLS**.
3. In the desired request, click **Actions > Request signature**.
  1. In the **General** tab, enter the system data.
  2. In the **Contact** tab, enter the contact information for the GlobalSign order.
  3. In the **Profile** field, select your MSSL profile. This field is required for an MSSL CA, and Segura® validates the profile when it signs the request.
  4. Click **Save**.

After you request the signature, Segura® checks the domain in your MSSL profile:

- If the domain is already validated, Segura® orders the certificate. The status can pass through **Waiting signature** before it changes to **Signed**.
- If the domain is not in the profile, Segura® adds it, and the request waits for domain validation.
- If the domain validation has expired, Segura® renews it, and the request waits for domain validation.

## Validate the domain

While the request waits for domain validation, get the validation file from your GlobalSign account and publish it on the web server of the domain, at:

```
https://<domain>/.well-known/pki-validation/gsdv.txt
```

HTTP file validation is the only method for MSSL. On the next execution, Segura® asks GlobalSign to verify the domain and continues with the order.

## Errors

| Error | Cause |
| --- | --- |
| `-9901` | The product is not allowed for your GlobalSign account. |
| `-9911` | The GlobalSign account does not have enough credit. |
| `-9401` | The MSSL profile is not valid. |

The signature also fails if you request a DV certificate through an MSSL CA, or if the MSSL profile is not available or cannot be validated.

## Renew the certificate

GlobalSign MSSL certificates can be renewed the same way as other certificates in the Segura® Platform. For information on the renewal flow, see [About certificate renewal](/v4-2/docs/clm-about-renewal).

## Revoke the certificate (if necessary)

1. On **Segura® Platform**, in the navigation bar, hover over the **Products menu** and select **Certificate Manager**.
2. In the side menu, select **Certificates > SSL/TLS**.
3. In the desired certificate, click **Actions > Revoke certificate**.
4. Click **Yes** to confirm the revocation.
5. A request is sent to GlobalSign and the status of the certificate in the **Segura® Platform** changes to **Revoked**.