FAQ: Email certificates

To enroll for a Digital ID complete the online enrollment application using either Microsoft Internet Explorer or Netscape Navigator. The email address you provide during enrollment will be bound to your Digital ID. Once installed, you can digitally sign your email and receive encrypted email using any POP-based email client such as Microsoft Outlook, Microsoft Outlook Express, or Lotus Notes.

Shortly after completing the enrollment, you will receive an email from VeriSign containing a PIN and pickup URL. Your Digital ID will be installed automatically when you retrieve it from the pickup URL provided. Follow the appropriate installation instructions to configure your email client application.

When you backup a Digital ID, the system copies the private key created during the enrollment into an encrypted file. The backup to move the Digital ID to a new computer, replace a corrupted ID, or for safe keeping.

Challenge Phrase
A Challenge Phrase is a word or phrase that is used for security purposes. Your Challenge Phrase is the one positive means of identification should you require VeriSign to take emergency action against your Digital ID. Challenge Phrase need for Renewing, Replacing, Revoking certificates. If you lose your Challenge Phrase, VeriSign cannot authenticate who is making the request to take action against your certificate or ID.

Export or Backup a Digital ID
It is always recommended to create a proper backup file of your Digital ID. Should your suffer from loss or corruption of the Digital ID, a computer crash, or a new computer, you can import the backup file to re-store the ID in most cases. When you Export (backup) a Digital ID, the system copies the private key created during enrollment into an encrypted file. Select the correct Internet browser version below for Export (backup) instructions. After you have exported the file, you can Import or Move a Digital ID to another device.

• Microsoft Internet Explorer 5.x and Higher
  1. Click Tools > Internet Options > Content > Certificates
  2. From the list, under Personal tab, select the corresponding certificate to export
  3. Click Export
  4. A wizard appears, click Next
  5. Select Yes, Export the private key > Next
     * Note: if the option to export the private key is grayed out, please see SO5831
  6. Select Include all certificates in the certificates path if possible exports all certificates when possible
  7. Click Next
  8. Enter a password
  9. Click Next
  10. Enter a file name and a location to save the exported file (i.e. mydigitalid.pfx.)
  11. Click Finish
  
  * NOTE: You will still able to use the certificate on the current browser. The certificate will only be deleted if you select it and click Remove (or hit Delete).
• Mozilla Firefox 2.0 and 3.0
  1. From the menu bar, click on Tools > Options
  2. Click on Advanced> Encryption
  3. Click View Certificates
  4. Highlight your certificate by clicking on it
  5. Click Backup
  6. Select the location you wish to save the certificate to
  7. Enter your master password for the Software Security Device
  8. Enter a password to protect your certificate and private key
  9. Click OK
  10. A message confirms that the backup procedure was successful
  11. Click OK
• Google Chrome
  1. Open a Google Chrome Browser.
  2. Go to "Customize and control Google Chrome" > Options > Under the Hood > Manage certificates
  3. Select the Personal tab, select the certificate
  4. Click Export > Next
  5. Select the option button Yes, export the private key (if doesn't ask this, it means that the file is corrupted or you are not logged in as admin in the machine)
  6. Activate the checkbox Include all certificates in the certification path if possible
  7. Choose a password, confirm password and click Next.
  8. Click Browse and specify the path where you want to save the exported certificate to (with extension *.pfx) and click in Next".
  9. Verify the information is correct, and then click Finish. A message will confirm The export was successful.

Renew a Class 1 Digital ID
During enrollment for a Class 1 Digital ID, a Challenge Phrase is required to be entered. The correct challenge phrase is required when renewing a Class 1 Digital ID. If you do not the Challenge Phrase, you will not be able to perform a Renewal of the ID. For security purposes, VeriSign does not have access to the challenge phrase. If you cannot remember the challenge phrase, you must enroll for a new certificate instead. When enrolling for the new digital ID, make a change to your name, so the new ID will not be a duplicate of the original. Changes can be anything, including capitalizing a letter or adding your middle initial. To enroll for a new Digital ID, go to: http://www.verisign.com/products-services/security-services/pki/pki-application/email-digital-id/index.html. You must resend your new signature regardless of whether you enroll for a new ID or renew an existing ID.

How to replace a Class 1 Digital ID?

1. If you have forgotten the Challenge Phrase of your certificate, you must send an e-mail with some personal information and information on your Digital ID to VeriSign so it can manually revoke the certificate and send you a token. 
   • You can obtain all the necessary information to include in the e-mail by searching for your Digital ID on VeriSign's Digital ID page. Go to: https://digitalid.verisign.com/services/client/index.htm
2. Send an e-mail to id-support@verisign.com with the following information:
   • Name
   • E-mail Address
   • Serial Number
   • A brief description of the issue
3. After receiving the information, VeriSign manually revokes your Class 1 Digital ID and issues you a token that allows you to obtain a new Digital ID without having to enter payment information
4. To enroll for a Class 1 Digital ID using the token, go to https://digitalid.verisign.com/client/class1MSToken.htm

How do I revoke a Class 1 Digital ID without the Challenge Phrase?
To ;revoke a Class 1 Digital ID without the Challenge Phrase, follow these steps:
1. If you have forgotten the Challenge Phrase of your certificate, you must send an e-mail with some personal information and information on your Digital ID to VeriSign to manually revoke the certificate.  You can obtain all the necessary information to include in the e-mail by searching for your Digital ID on VeriSign's Digital ID page.
2. Send an e-mail to id-support@verisign.com with the following information: Name, E-mail Address, Serial Number
3. After receiving the information, VeriSign will manually revoke your Class 1 Digital ID.