Getting a Verified Mark Certificate from SSL.com

What SSL.com actually issues

SSL.com is a Mark Verifying Authority, which is the role a certificate authority plays when it vouches for a logo rather than a website. It issues three products in this category.

A Verified Mark Certificate, or VMC, is backed by a registered trademark. It is the one that produces the blue checkmark next to your name in Gmail. A Common Mark Certificate, or CMC, is backed by twelve months of documented logo use instead of a trademark. Gmail accepts CMCs and will show your logo, but a CMC does not produce the checkmark. A Government Mark Certificate, or GMC, is for government entities that can point to enabling legislation, and it carries the same weight as a VMC.

SSL.com is a small issuer by volume. Research against public Certificate Transparency logs put SSL.com's cumulative BIMI issuance at roughly 123 certificates as of early July 2026, against DigiCert's share of about 74 percent of all mark certificates ever issued. That is not a reason to avoid them. Mailbox providers accept SSL.com certificates. It does mean you are dealing with a smaller validation queue, which cuts both ways.

• VMC: registered trademark required, produces the Gmail checkmark
• CMC: no trademark, 12 months of logo use, logo displays but no checkmark
• GMC: government entities only, enabling legislation as proof of rights

What it costs

SSL.com publishes its prices, which is more than some issuers do. Multi-year terms are discounted but prepaid.

One thing to understand before you buy a three-year term. A mark certificate is still issued for a maximum of 397 days, so a three-year purchase was never one long-lived file. The industry-wide move to shorter certificate lifetimes applies to SSL/TLS certificates, not mark certificates. Your purchase is an annual license, and SSL.com reissues the certificate mid-term at no extra charge. You are buying a service term, not a file that sits untouched for three years. Budget the admin time for reissues, because when the file changes, the certificate URL in your BIMI DNS record has to keep pointing at something current.

• VMC, 1 year: $1,500
• VMC, 2 years: $1,350 per year
• VMC, 3 years: $1,275 per year
• CMC, 1 year: $1,150
• CMC, 2 years: $1,035 per year
• CMC, 3 years: $977.50 per year

The officer requirement, which is where most applications stop

This is the part almost nobody accounts for, and it is the reason we tell some people not to start.

SSL.com requires a Designated Individual to complete identity verification. That person is either the Contract Signer, who signs the subscriber agreement on behalf of the organization, or the Certificate Approver, who approves certificate requests. One person can hold both roles.

That individual has to hold a recognized corporate title. SSL.com lists the accepted ones explicitly: CEO, President, Corporate Secretary, Treasurer, Vice-President, COO, CIO, CFO, CSO, Managing Member, Director, or Department Head.

Read that list carefully, because it is narrower than it looks. Director here means a company director or the head of a department. It does not mean Director of Demand Generation or Director of Marketing Operations. A marketing manager does not qualify. An IT administrator does not qualify. Your web developer does not qualify. And your agency, including us, cannot stand in for this person, because the whole point of the check is that a verified officer of your organization is personally attesting to the application.

Entity type matters too. SSL.com issues to private organizations such as an LLC, Ltd, GmbH or equivalent, to government entities, to unincorporated business entities that are officially registered, and to non-commercial entities such as international organizations. Individuals cannot obtain a VMC. If you trade as a sole proprietor with no registered entity behind you, you are not eligible, and no amount of paperwork changes that.

How the identity check actually runs

SSL.com calls this Face-to-Face verification, which is a slightly misleading name in 2026. There is no appointment with a notary and nobody visits your office. SSL.com uses a third-party AI identity verification provider, and its own validation team then reviews the result manually.

There are two paths. The automated one is the one to take. You use a smartphone to photograph the front and back of a government-issued photo ID, then complete a liveness check, which is a short real-time step where you follow on-screen prompts such as blinking or turning your head. It confirms a live person is holding the document.

The manual fallback requires three images: the front of a valid government-issued photo ID, the back of the same ID, and a photograph of the officer holding that ID next to their face. SSL.com asks for at least five megapixels. It is slower and more likely to bounce back for a reshoot.

In the United States, SSL.com accepts a passport, driver's license, state ID, military ID, or green card. Other countries have their own accepted lists. If the primary document does not show a residential address, SSL.com may ask for a second document that does, so have a utility bill or bank statement ready rather than scrambling for one mid-process.

Two practical notes. Do it on a phone rather than a laptop webcam, because the camera quality and the ability to move the document around make a real difference to the pass rate. And do not run the session in a private or incognito browsing tab, which SSL.com specifically warns against.

The trademark has to be registered, not pending

For a VMC, your trademark registration must be active and on file with an intellectual property office listed in the WIPO directory. That covers the USPTO, EUIPO, UKIPO, CIPO, IP Australia and a long list of others.

A pending application does not qualify. Certificate authorities will not issue against a mark that has not completed registration, so if you filed six months ago you are waiting. You can begin the purchase process when a mark is genuinely in the final stages, but do not treat that as a shortcut.

The mark also has to correspond directly to the logo you submit. Stylized variations, recolored versions and cropped portions of a registered mark all trigger additional review, and often rejection. This is the failure we hit on our own certificate. The logo has to match the registered mark, and the file has to match the mark bound into the certificate. If your registered mark is the wordmark and you want to display the icon, or the registration is in black and white and you want to submit it in team colors, resolve that before you apply rather than after.

If your mark is pending or you never registered one, a CMC is the honest alternative. It relies on evidence that your logo has been in active, continuous use on a domain you own for at least twelve months. SSL.com verifies that through website history and archived pages, so an unbroken record in the Internet Archive is worth more than a folder of marketing PDFs.

The logo file is where applications stall

The certificate is the expensive part. The SVG is the fiddly part, and SSL.com names non-compliant SVG files as one of the most common reasons a VMC application is delayed.

The required format is SVG Tiny Portable/Secure, usually written SVG Tiny P/S. It is a deliberately restricted profile designed so that a logo file cannot carry anything executable. Exporting an SVG from Illustrator or Figma does not produce it. The file has to be edited afterwards.

One detail worth flagging. SSL.com's own documentation is inconsistent on the size limit. Two of its pages state 30 KB and one states 32 KB. Build to 30 KB and the question never comes up.

The line ending requirement catches people out more than anything else on this list. If your officer or developer opens the file in a Windows editor and saves it, the editor will quietly convert every line to CRLF and the file will fail validation with no obvious reason why. Check line endings after every single edit.

• baseProfile attribute set to tiny-ps
• Square 1:1 aspect ratio
• Solid, non-transparent background
• A title element containing the organization name
• No scripts, no external references, no animation
• x and y attributes removed, and overflow="visible" removed
• LF line endings only, never CRLF, and UTF-8 encoding
• Under 30 KB

DMARC and the BIMI record

None of this displays without DMARC enforcement. Your domain needs a DMARC policy of p=quarantine or p=reject. A monitoring-only policy of p=none is not sufficient and will stop your logo rendering in most email clients, certificate or no certificate.

The order is SPF, then DKIM, then DMARC at p=none while you read the reports, then enforcement. On a domain with several sending services, moving to enforcement safely takes weeks of reading aggregate reports and fixing alignment, not an afternoon. Rushing it breaks legitimate mail.

Once the certificate is issued, you publish a TXT record at default._bimi.yourdomain.com with a TTL of one hour. For a VMC or GMC it takes the form v=BIMI1; l=[logo URL]; a=[certificate URL];. For a CMC you omit the a= tag entirely, since there is no certificate to point at. SSL.com will host the SVG for you at bimi.ssl.com and hand you the exact record.

One myth to drop. Sender reputation is not the gate for issuance. We spent months on sender reputation before our own application and it made no difference, because it is not what is being assessed at this stage. Reputation affects whether a given mailbox provider chooses to render your logo, which is a separate question from whether a CA will issue the certificate.

How long it takes

SSL.com states 3 to 5 business days for validation across VMC, CMC and GMC, measured from purchase and document submission. That figure is realistic for the validation itself, assuming your officer completes the ID check promptly and your SVG is already compliant.

It is not the project timeline. The long poles sit before validation starts. If you need a trademark, that is measured in months to years depending on the office. If you need to reach DMARC enforcement on a live mail estate, budget four to eight weeks of careful work. If your logo needs converting and the registered mark does not match what you actually use in email, resolve that first.

After the DNS record goes live, allow time for mailbox providers to pick it up. Gmail and Apple Mail do not render instantly, and display support varies by client.

When we would tell you not to buy

We would rather turn work away than take a fee for something that cannot succeed. These are the situations where we say no.

You want the blue checkmark and you have no registered trademark. A CMC is cheaper at $1,150, and it will show your logo in Gmail, but it will not produce the checkmark. If the checkmark is the actual goal, a CMC is $1,150 spent on the wrong product.

Your trademark is pending. Wait for registration, or buy a CMC now and move to a VMC later.

You are a sole proprietor with no registered entity. You are not eligible for any of these.

Nobody at your company holds one of the accepted officer titles, or the person who does will not complete a biometric identity check. There is no way around this and no agency can substitute.

You cannot get to p=quarantine or p=reject. Without enforcement the certificate sits unused.

Your email volume is low. If you send a few hundred transactional messages a month, $1,500 a year is difficult to justify on brand recognition alone. Fix DMARC, which costs nothing but time, and revisit the certificate when volume warrants it.

Working with us

We ran this whole stack on our own business first. Bench Clearers, a hockey apparel store, has a Verified Mark Certificate issued through GlobalSign, BIMI live in Gmail, and Meta Verified on a 52,000-follower Instagram account. We know the specific places this breaks because we hit them ourselves, including the logo-to-registered-mark mismatch and the months we nearly wasted chasing sender reputation that was never the blocker. We work only through official channels, we never take passwords, ID documents or card numbers, and we screen applications before quoting. If we do not think yours will be approved, we will tell you that instead of taking the fee. No platform outcome is ever guaranteed, because the certificate authority and the mailbox providers decide, not us.