Having gone through the process myself, it’s not trivial. We first tried through GoDaddy who shouldn’t even offer the service to South Africans because they “r

Having gone through the process myself, it’s not trivial. We first tried through GoDaddy who shouldn’t even offer the service to South Africans because they “required” a photograph of a company director holding a government issued photo identity document with physical address included. There is no such type of document here. We offered affidavits, lawyers letters, but they were unbending. We then tried and managed to succeed through Digicert. Their process involved a few checks including checking local government mandated company registry and using the telephone number from that registry to phone a director to confirm they were aware of the certificate request. Bad guys can certainly get this done, but it raises the bar very substantially, and once they’ve burned their credibility of the company the certificate is issued against, they have to use a different company.