The signing certificate: what it is and what to ask for

Every eCoC file has to carry a digital signature or the VCA reject it. In the last fortnight we've seen a manufacturer sent three different things when someone asked for "the signature": a password-manager login, a Word document of scanned handwritten signatures, and a PDF with a signature image on it. None of them is it.

What it actually is

A certificate issued to the company, not a person, by a trust service provider. Think of it as an electronic company stamp. Software uses it to produce a block of characters, derived from the file's contents, that proves the file came from your company and hasn't been changed since. Alter one character in the file and the signature no longer matches.

The technical name is an electronic seal, under the eIDAS regulations. The VCA's guidance says to sign the way EU manufacturers do, and the VCA currently check that a signature is present rather than which tier of seal was used. Seals come in two tiers, "advanced" and "qualified"; ask the VCA which they will accept before you buy. The signature format is XAdES.

Where you get one

From a trust service provider, in the company's name. The application will need someone with authority over the company, a director typically, to prove the company's identity. Budget hundreds to low thousands of pounds a year, not tens of thousands.

Before you pick a provider, email ecocdataenquiries@vca.gov.uk and ask which providers they accept for UK manufacturers and whether an advanced seal is sufficient. They've been asked this by every small manufacturer already.

What you'll receive

Two things: a certificate (the public half, fine to share) and a private key (the secret half, never to be emailed or pasted anywhere). Some providers give you files; some keep the key on their servers and sign via a cloud service. Ask which, because it changes how the signing step works in your software. If they give you files, you'll usually get a single .pfx (or .p12) file and a password: that is exactly what CoC AutoDocs asks for on its Signing page, on the PC that makes the files. No converting, no command line.

What to do in the meantime

Don't wait. The VCA currently only check that a signature is present, so a test key gets files through the test portal today. CoC AutoDocs has one built in. Use it to get your setup, your models and your first uploads sorted, then swap in the company certificate when it arrives.