eSigner Subscription and Credential Termination Policy for Unpaid Invoices

Overview 

If an invoice for your eSigner subscription is still unpaid more than 60 days after its due date, eSigner suspends new signing and gives you 30 days to pay. If the payment is still unresolved after those 30 days, your eSigner signing credential is permanently terminated and its certificate is revoked.  For most teams, signing is not a side task. A code signing credential sits inside release pipelines, and a document signing credential sits inside contract, invoice, and approval workflows. An expired card or a declined renewal that goes unnoticed can eventually stop a software release or a signed agreement. Knowing how the policy works lets you prevent an interruption, and recover quickly if one happens.  This guide explains: 

• What triggers a suspension and what is affected 

• The timeline from an unpaid invoice to termination, including when you will be notified 

• What termination means for files you have already signed 

• How to restore service and how to keep it from happening 

Key point: Pay the overdue invoices within 30 days of suspension and signing comes back automatically, with the same credential and certificate. After 30 days, the credential cannot be reactivated and a new order is required. 

Who this policy applies to 

The policy applies to every active eSigner subscription billed by invoice to your SSL.com account, whether the invoice is paid by credit card or from account funds, for both eSigner products: 

Product	Typical use	What a suspension stops
eSigner for Code	Signing executables, drivers, installers, scripts, and packages, often from CI/CD pipelines	New code signing operations through eSigner (CodeSignTool, eSigner CKA, CSC API, and CI/CD integrations)
eSigner for Documents	Signing PDFs and Office documents with a publicly trusted document signing certificate	New document signing operations through eSigner

It matters to anyone who depends on eSigner signing: 

• Business owners and decision-makers who hold the subscription and the card on file. 

• IT managers and PKI administrators who manage signing credentials for a team. 

• DevOps engineers and developers whose build pipelines call eSigner to sign releases. 

• Finance and accounts-payable staff who manage corporate or rotating cards. 

In many organizations, the person who pays for eSigner is not the person who uses it. A card can expire in finance while a pipeline fails in engineering. Make sure both groups know this policy exists. 

Why SSL.com uses this policy 

An eSigner credential lets its holder produce signatures that operating systems, browsers, and PDF readers trust on behalf of a verified identity. Allowing that credential to keep signing while its subscription is unpaid creates room for misuse and complicates billing disputes. Suspending signing once an invoice is well overdue closes that gap. The 60 days before suspension, and the 30-day grace period after it, protect legitimate customers, whose cards simply expired or were replaced, from losing a validated credential over a short-lived billing problem. 

How the policy works 

The policy runs in two phases, measured in days from the date signing is suspended (Day 0). Suspension happens when an eSigner invoice is still unpaid more than 60 days after its due date, the last day of the month the invoice covers. Until then, an unpaid invoice does not affect signing, and you can pay it at any time.  eSigner nonpayment timeline · Day 0 to Day 30  Signing is blocked from Day 0, but nothing is deleted or revoked until Day 30. 

Day	What happens	Your credential	What you receive
Day 0	An eSigner invoice is still unpaid more than 60 days after its due date. New signing is suspended.	Retained, but locked for signing	Suspension notice explaining that payment is required to maintain eSigner subscription.
Day 7	Reminder	Locked	Warning email
Day 14	Reminder	Locked	Warning email
Day 27	Final reminder, three days before termination	Locked	Final warning email
Day 30	Payment still unresolved. The credential is terminated and its certificate is revoked.	Permanently terminated	Termination notice
Any day before Day 30	You pay all overdue eSigner invoices.	Signing restored automatically, same credential and certificate	—

Notices go to the team members who manage billing for your SSL.com account (owner, account admin, billing, and reseller roles) and to the contacts on the certificate order. Warning and termination notices also go to the user who holds the credential. 

Phase 1: Immediate suspension (Day 0) 

Suspension starts on the day an eSigner invoice becomes more than 60 days overdue. It is not a warning period: signing requests made after this point are refused. 

• Blocked: new code signing and document signing operations through eSigner. 

• Not affected: files you signed before the suspension. Their signatures remain valid. 

• Kept: your signing credential, your certificate, and your completed identity validation. Nothing is deleted or revoked in Phase 1. 

The 30-day grace period 

During the 30 days after suspension, your credential is held in a locked state. Paying the overdue balance at any point in this window reinstates signing automatically. You do not need to reorder, re-validate, re-enroll in eSigner, or re-issue the certificate, and your pipelines keep the same credential ID. 

Phase 2: Termination (Day 30) 

If the payment is still unresolved 30 days after suspension, SSL.com terminates the eSigner credential and revokes the associated certificate. Termination is permanent: 

• The credential cannot be reactivated, even if you pay afterward. 

• To sign again, you need to place a new order, which includes a new certificate and new eSigner enrollment. 

• The termination is logged in your account’s audit history. 

Every step is recorded 

Each event in the lifecycle (suspension, each warning sent, restoration, and termination) is written to an audit log. If you dispute a suspension or need to show when signing was unavailable, SSL.com support can confirm the timeline. 

What termination means for files you have already signed 

Signed files that carry a trusted timestamp generally keep validating after the certificate is revoked, because the timestamp proves the signature was made while the certificate was still valid. Files signed without a timestamp are at risk. 

Code signing 

Code signing certificates are governed by the CA/Browser Forum Baseline Requirements for Code Signing Certificates (CSBRs). When a CA revokes a code signing certificate, it publishes a revocation date. Platforms such as Windows Authenticode check a signature’s RFC 3161 timestamp against that date: 

• Signed and timestamped before the revocation date (for a nonpayment termination, the day the credential is terminated): the signature continues to validate. Software you already shipped keeps installing without new warnings. 

• Not timestamped: the signature is judged against the current revocation status, so it may fail validation once the certificate is revoked. 

eSigner signing tools apply an SSL.com timestamp by default. If your pipeline overrides or disables the timestamp step, fix that now: it is the main thing protecting your shipped releases from a future revocation for any reason. 

EV code signing 

EV code signing certificates require the private key to be generated and kept in a FIPS 140-2 Level 2 or higher hardware security module. With eSigner, that HSM is SSL.com’s cloud signing infrastructure, so the key is never exported to you. When the credential is terminated, the key can no longer be used and cannot be moved elsewhere. A new EV certificate means a new key, and Windows SmartScreen reputation attached to the old certificate does not carry over automatically. 

Document signing 

PDF signatures that include a trusted timestamp and embedded long-term validation (LTV) data stay verifiable in Adobe Acrobat and other readers after revocation. Signatures made without a timestamp may show as invalid or unknown once the certificate is revoked. Signing requests made during a suspension are refused outright, so no document ends up partially signed.  Important: Revocation is a public, permanent record. A revoked certificate cannot be un-revoked, which is why the policy allows 30 days before Phase 2. 

How to restore signing after a failed payment 

If you received a suspension or warning notice, follow these steps. They take a few minutes, and signing resumes automatically shortly after the payment goes through. 

Prerequisites 

• Login access to the SSL.com account that owns the eSigner subscription (an account administrator, or a user with billing permissions). 

• A valid credit card that is not near its expiration date. 

• The suspension or warning email, to identify the affected order and credential. 

• It is still before Day 30. After Day 30, see “If your credential was already terminated” below. 

Steps 

1. Read the notice. Note the affected eSigner invoice and the date signing was suspended. Count forward 30 days from the suspension: that is your deadline. The warning emails also state the exact termination date. 
2. Log in to your SSL.com account at secure.ssl.com. 
3. Update your payment method. Open the billing area of your account and add a new billing profile, or update the card on the existing one. Set the working card as the default so future renewals use it. 
4. Pay all overdue invoices. Find every unpaid eSigner invoice that is past due and pay it with the updated card. Signing is restored only when no eSigner invoice for the credential is still more than 60 days overdue, so paying one invoice while another overdue one stays open is not enough. Updating the card alone may not retry the failed charge. 
5. Confirm signing is restored. Run a test signature, for example a single file with CodeSignTool or a test PDF. Restoration is automatic once the overdue invoices are paid; no re-issuance or re-enrollment is needed. 
6. Re-run any failed jobs. Restart CI/CD builds or document workflows that failed while signing was suspended. 
7. Contact support if anything looks wrong. If signing is still blocked after payment, or you believe the suspension was applied in error, contact SSL.com support by chat or email. Include your order or invoice number and the date of the notice. 

If your credential was already terminated 

After Day 30, payment no longer restores the credential. To resume signing: 

1. Place a new order for the eSigner code signing or document signing product you need. 

1. Complete validation for the new certificate. 

1. Enroll the new certificate in eSigner and note its new credential ID. 

1. Update your signing tools, scripts, and pipeline secrets to use the new credential. 

Plan for the new order to take as long as the original one did, because the certificate must be validated before issuance. 

Best practices to prevent an interruption 

Most suspensions come from ordinary billing changes: an expired card, a reissued card after fraud, or a corporate card rotated by finance. These habits keep signing running.  Billing 

• Check the card’s expiration date now, and set a calendar reminder a month before it expires. 

• Add a backup billing profile so a replacement card is ready. 

• Act on any declined-payment email from SSL.com right away. The invoice stays open, and signing is suspended once it is more than 60 days overdue. 

• Tell your finance team which charges belong to eSigner, so a rotated or cancelled card is updated in your SSL.com account too. 

• Ask your bank or card issuer to allow recurring charges from SSL.com if they tend to flag them. 

Notifications 

• Make sure the account email address reaches a monitored inbox. A shared address (for example, a PKI or IT alias) is more reliable than one person’s mailbox. 

• Treat a suspension notice as urgent: signing is already blocked when it arrives. 

CI/CD pipelines and automation 

• Make signing failures fail the build loudly and alert the team, rather than shipping unsigned artifacts. 

• Always timestamp signatures, so shipped software and signed documents stay valid if a certificate is ever revoked. 

• Document where eSigner credentials are referenced (pipeline secrets, scripts, signing servers) so a replacement credential can be rolled out quickly. 

Governance 

• Assign an owner for each eSigner subscription who is responsible for billing and renewal. 

• Review subscriptions at least once a year and remove ones you no longer use, rather than letting a payment lapse. 

Conclusion 

The eSigner termination policy is designed to be predictable: signing stops only once an invoice is more than 60 days overdue, you then get three reminders, and nothing is lost permanently until 30 days after suspension. Keeping a valid card on file and a monitored email on your account is usually all it takes to never see a suspension.  The policy also protects you. Because an unpaid credential cannot keep signing, a publicly trusted signature tied to your verified identity cannot be produced from a lapsed account. Combined with timestamped signatures, this keeps your shipped software and signed documents trustworthy and your releases on schedule.  For help with billing or an eSigner credential, contact SSL.com support. For background on how eSigner credentials work, see the eSigner Signing Credential Guide and the eSigner FAQ.