How to Obtain a STIR/SHAKEN Certificate: Complete 4-Step Process

Obtaining a STIR/SHAKEN certificate is a critical step for any voice service provider. This digital certificate allows you to sign outbound calls with a cryptographic signature that proves their authenticity. The process involves four key steps: getting an FCC 499 Filer ID, obtaining an OCN number, completing STI-PA registration, and choosing a Certificate Provider.

Step 1: Get Your FCC 499 Filer ID

An FCC 499 Filer ID is a unique identification number assigned by the FCC to companies that provide telecommunications services in the United States.

To get one: go to the FCC Registration System (CORES), create an FCC username if you don't have one, log in and register your business entity with legal name, address, contact details, and tax ID information. You'll receive an FCC Registration Number (FRN) once the business is created, then file Form 499-A or 499-Q for the first time, which generates your Filer ID.

Timeline: same-day issuance after submitting all required forms. Cost: free.

Step 2: Obtain Your OCN Number

An Operating Company Number (OCN) is a unique four-digit code assigned by NECA to identify telecom carriers and VoIP providers for routing, billing, and regulatory purposes.

Visit the NECA website, choose online or printable form submission, complete the form, and attach required documents: an interconnection agreement with an upstream carrier, an invoice copy with a customer, a certified copy of Articles of Association, and basic administrative details.

Timeline: about 10 business days. Cost: $475 standard, or $600 for expedited 3-business-day processing.

Step 3: Complete STI-PA Registration

STI-PA (Secure Telephone Identity Policy Administrator) Registration authorizes a telecom provider to participate in the STIR/SHAKEN framework and obtain certificates for authenticating and verifying calls.

Visit Iconectiv Authenticate, navigate to Provider Registration, click "Begin Registration," and complete the form with your company name and address, FCC 499 Filer ID, OCN, and billing contact details.

You'll receive your Service Provider Code (SPC) Token, typically within 3 to 5 business days. The token is valid for one year and must be renewed periodically.

Step 4: Choose a Certificate Provider

A Certificate Provider (Certificate Authority) is an organization authorized to issue digital certificates verifying the identity of telecom providers within the STIR/SHAKEN framework. Options include TransUnion, PeeringHub, and other approved CAs.

Visit your chosen provider's website, complete registration, submit your SPC Token, provide company information, and create a Certificate Signing Request (CSR). Your STI Certificate is typically issued almost immediately after approval. Most CAs charge an annual fee for issuance and maintenance.

Complete Checklist

Common Pitfalls to Avoid

• Not applying for an OCN first — you cannot complete STI-PA registration without one.
• Using incorrect or incomplete documentation.
• Missing the SPC token renewal — tokens must be renewed annually.
• Letting your certificate expire — monitor your expiration date.
• Not registering in the RMD — even with a certificate, RMD registration is still required.

After Obtaining Your Certificate

Once you have your certificate, upload it to your PBX or authentication service, configure your signing and verification strategy, and register in the FCC Robocall Mitigation Database (RMD). Many modern PBX platforms let you upload your certificate directly and handle signing and verification automatically.

Conclusion

Obtaining a STIR/SHAKEN certificate requires navigating multiple regulatory bodies and technical requirements. By following this four-step process, you can achieve full compliance and start signing your calls with confidence.