Frequently Asked Questions (FAQ)

What are the ORC Help Desk Assistance hours? ORC Representatives are available for telephone assistance from 7am-7:30pm (Eastern) Monday through Friday Customers can create Help Desk Tickets (and review the status of tickets) 24 hrs a day on our ACES help desk page. There are many instructions available on our instructions page.
Does ORC issue passwords? Can ORC reset passwords? If not, why not? No.  ORC has no knowledge of the certificate password.  ORC cannot reset any certificate password. Federal government certificate policies (ECA, ACES, NFI) require that every certificate private key be protected by a password or PIN. But the certificate key pairs are generated on the client computer or cryptographic device (like a smartcard), then the public key is sent to the ORC Certificate Authority (CA) servers.The private key is not sent to the ORC servers. ORC never has a copy of the certificate private key. Since the password is set on the certificate private key and ORC never has the private key, ORC has no knowledge of the password assigned to the key, nor can ORC re-set the password.
How long will it take to get my certificate after I send you the paperwork? ORC will process your request forms within 3-5 business days of receipt at our Fairfax office. In that time frame, you’ll be notified by email if there are any problems with your request. If there are no problems, you’ll receive an issuance notification email with instructions for importing and backing up your certificate(s).
Does ORC offer free certificates? No.
Do I need an appointment to bring my requests to your office for identity verification? No appointment is necessary for ACES certificates. Please review our walk-in page for information about what you need to bring to our office.
What are your locations? Fairfax, Virginia
When are you open? ORC’s hours of operation are 9am-5pm Mon-Fri (except Federal Holidays)
What are certificate prices for ACES Medium Assurance Certificates? Pricing for ACES Certificates is available on our pricing page.
My certificate will be expiring soon. When can I renew it? Your certificate will be eligible for renewal beginning thirty (30) days before its expiration date and ending upon its expiration. ORC will send out a certificate expiration notification email with a link to renew your certificate.
My certificate has expired. How do I renew it? Expired certificates cannot be renewed. You must make a request for a new certificate and undergo identity verification again, just like you did the first time you requested a certificate.
Will I get a receipt for my credit card payment? ORC will email you a copy of your receipt when your credit card is charged. Watch your spam/junk folder, as it is an automated message from our credit card system and is sometimes mistaken for spam.
I’m the president/owner/sole member of my company. How do I prove my affiliation? You may sign the proof of organizational affiliation letter for yourself. Put your own information in the boxes for both “duly authorized representative” and “subscriber”. Alternately, you may submit a copy of legal business documentation showing your affiliation to the company (articles of incorporation, business license etc).
My computer was upgraded, crashed, had a failure/virus and/or my certificate is no longer working. When your certificate was issued, ORC sent you a certificate issuance notification email with instructions to make an export (back-up) copy of your certificate once imported. The file extension of your back-up copy will be *.pfx or *.p12. You may want to search those file extensions to see if you are able to locate the back-up copy of your certificate. If you made a back-up copy of your certificate, please follow the below instructions for importing your certificate.Internet Explorer: Click on the following link for import instructions, http://aces.orc.com/docs/instructions_Import_Cert_from_Backup_file_IE.pdf After you import your certificate, please go to our ACES Trust CAs page. Follow the instructions to install both root/signing CAs, then go to our certificate test page to test your certificate. Click on the link at the bottom of the page. Your certificate will show up in the window, click okay, then you will be prompted for your password, please enter and click okay. If your certificate is working properly the page will display You Possess a Valid Certificate.

Firefox: Click on the following link for import instructions, http://aces.orc.com/docs/instructions_import_BackUp_certs_Firefox.pdf After you import your certificate, please go to our ACES Trust CAs page. Follow the instructions to install both root/signing CAs, then go to our certificate test page to test your certificate. Click on the link at the bottom of the page. Your certificate will show up in the window please click okay. If your certificate is working properly the page will display You Possess a Valid Certificate.

If you are receiving an error when attempting to import your certificate or if you do not have a back-up copy of your certificate you will need to request and pay for a new ACES Certificate.

Can I request multiple ACES certificates for multiple companies and/or DUNs numbers I work/contract with? GSA would like you to obtain only one certificate in your company’s name. Then any other company/DUNs number you work with needs to designate you as an authorized negotiator for their DUNs/company in the eOffer/eMods system. If you have any other questions or concerns is this regard please contact your GSA contracting officer or the eOffer/eMods help desk 1-866-472-9114 or eoffer@gsa.gov.
What is the difference between and identity and encryption certificate? An identity certificate is used to access PKI-enabled websites and to digitally sign emails (by digitally signing an email a third party may view the email but they cannot alter the email). If you use an older version of Outlook for your email client, you may need to have both an Identity and Encryption Certificate in order to be able to digitally sign e-mail. Encryption certificates are used to send encrypted email (emails that cannot be altered or viewed by a third party). Both parties must have Encryption certificates in order to successfully exchange encrypted email.
I’m a non-US Citizen can I request an ACES certificate? At this time, the ACES Certificate Policy (which is written by the GSA) does not specifically address non-US citizens, nor certificate requests made outside the US. But they are also not prohibited. So we ask that you indicate your true address in the text fields, select Virginia for the State and leave United States alone. After you print your request form please write in the correct address information. You must appear before a US Consular Notary official with your printed request form.
My email address has changed or my email address is wrong, how do I change it? ORC issued the certificate as it was requested. Unfortunately, ORC cannot change the contents (i.e. name, email address) of a certificate once it has been issued.  ORC can re-issue the current certificate for a ‘certificate update’ fee to reflect the correct email address.
My name is not correct on my certificate it does not match GSA system; how do I change it? ORC is required by the GSA’s ACES Certificate Policy to issue ACES certificates exactly as we have done. We are required to use your legal name with Middle Initial (if the subscriber has a middle initial) and not any names that you might go by. Our web site instructs potential subscribers to enter their legal name (with middle initial).
How can I be added as an Authorized Negotiator? You will need to contact your Contracting Officer or the eOffer/eMod help desk 1-866-472-9114 or eoffer@gsa.gov, regarding the Authorized Negotiator.
I’m receiving “The specified CSP cannot be found…” error at DTrades website. The error you are receiving is not a certificate error. Please see DTrade’s FAQ for more information on the error you are receiving: http://www.pmddtc.state.gov/faqs/documents/FAQs_dtrade.pdf Q: Why do I get the error message “The specified CSP cannot be found…” when I try to sign a DSP form on my Windows 7 system? A: With the deployment of Windows 7 with Internet Explorer 8, PureEdge Viewer cannot connect to the digital certificate on IE8 to complete the digital signature of the form. Industry users are directed to uninstall PureEdge Viewer and replace it Lotus Forms Viewer available on the DTrade Information Center web page.
How can I move my certificate from Firefox to Internet Explorer? When your certificate was issued, ORC sent you a certificate issuance notification email with instructions to make an export (back-up) copy of your certificate once imported. The file extension of your back-up copy will be *.pfx or *.p12. You can use your back-up to re-import your certificate. Please click on the following link for import instructions for Internet Explorer. After you import your certificate, please go to our ACES Trust CAs page. Follow the instructions to install both root/signing CAs, then go to our certificate test page to test your certificate. Click on the link at the bottom of the page. Your certificate will show up in the window, click okay, then you will be prompted for your password, please enter and click okay. If your certificate is working properly the page will display You Possess a Valid Certificate.
Can I use my certificate on multiple computers? Yes, you can use your certificate on multiple computers, but not by multiple users. ECA and ACES certificates are issued to individuals, not organizations and may not be shared.
How can I use my certificate on multiple computers? When your certificate was issued, ORC sent you a certificate issuance notification email with instructions to make an export (back-up) copy of your certificate once imported. The file extension of your back-up copy will be *.pfx or *.p12. You can use the back-up copy of your certificate to re-import into another computer. Please follow the below instructions for importing your certificate.Internet Explorer: Click on the following link for import instructions, http://aces.orc.com/docs/instructions_Import_Cert_from_Backup_file_IE.pdf After you import your certificate, please go to our ACES Trust CAs page. Follow the instructions to install both root/signing CAs, then go to our certificate test page to test your certificate. Click on the link at the bottom of the page. Your certificate will show up in the window, click okay, then you will be prompted for your password, please enter and click okay. If your certificate is working properly the page will display You Possess a Valid Certificate.Firefox: Click on the following link for import instructions, http://aces.orc.com/docs/instructions_import_BackUp_certs_Firefox.pdf After you import your certificate, please go to our ACES Trust CAs page. Follow the instructions to install both root/signing CAs, then go to our certificate test page to test your certificate. Click on the link at the bottom of the page. Your certificate will show up in the window please click okay. If your certificate is working properly the page will display You Possess a Valid Certificate.

If you are receiving an error when attempting to import your certificate or if you do not have a back-up copy of your certificate you will need to request and pay for a new ACES Certificate.

Does the Proof of Organizational Affiliation Letter count as one of the required photo IDs? No. If you are using the Proof of Organizational Affiliation Letter, you must still present two forms of photo ID.
Can somebody else at my company use my certificate after I leave? No. The purpose of the certificate is to identify the person accessing the web site (or signing the email, etc.). Certificate policy states that the only person authorized to use a certificate is the person actually named by the certificate. You are the only authorized user of your certificate. No one else may use your certificate, regardless of the reason.
Somebody at our company had a certificate but has left the company. Can we get a refund or credit for the remaining time on the certificate? No. ORC does not offer refunds or credits if a subscriber is unable to use the certificate for the full length of its validity period, regardless of the reason.
When will my Digital Certificate work with Google Chrome? Digital Certificates are already “Google Chrome friendly”. On Windows, Google Chrome uses the Microsoft cryptographic services inherent in the Windows operating system. These are the same cryptographic services used by Internet Explorer, Outlook, Office, etc. So, when you install your certificates ‘into’ Internet Explorer, you are also installing them into Chrome. Since Chrome is essentially identical to IE from a certificate standpoint, ORC does not produce instructions specific to Chrome. On Apple Mac OS X, Google Chrome and Apple Safari use Apple’s Keychain to provide cryptographic services, including certificate presentation.
How do I print my certificate? PKI digital certificates are not really something that you print.  Digital certificates are used by having them installed into a cryptographic module on a computer system that can be access by electronic applications like a web browser or email client.While a digital certificate can be rendered in a form where it can be printed, it won’t make much sense to most people.You should not confuse a digital certificate with a certification; certifications are often printed and stored/filed as a printed form.