A STIR/SHAKEN certificate is one of the most frequently misunderstood pieces of modern telecom compliance. Providers often use the term interchangeably with "A-level attestation," but the two describe completely different things.
A STIR/SHAKEN certificate is a digital certificate used within the STIR/SHAKEN caller-ID authentication framework to support cryptographic signing and verification of telephone calls. STIR/SHAKEN is designed to help address illegal caller-ID spoofing by allowing participating voice providers to authenticate information about the caller identity and digitally sign call signaling.
A critical point is that a certificate is not the same thing as A-level attestation. This distinction is often misunderstood. A provider may use a certificate to sign calls, while the call itself carries an attestation level describing the originating provider's relationship to the caller identity.
The three commonly discussed attestation levels are A — Full Attestation, B — Partial Attestation, and C — Gateway Attestation. The FCC's caller-ID authentication framework describes these attestation categories and the role of STIR/SHAKEN certificates.
01Why STIR/SHAKEN Matters
Caller ID is useful because it tells the recipient who appears to be calling. The problem is that traditional caller-ID signaling can be manipulated — a caller can potentially present a number that does not belong to the actual caller.
This can be exploited for fraud, impersonation, robocalling, social engineering, financial scams and fake customer-support calls. STIR/SHAKEN introduces cryptographic authentication into the voice ecosystem so that, instead of relying only on an asserted caller-ID number, participating networks can exchange cryptographically verifiable information.
Understanding the individual pieces of that ecosystem — the certificate, the attestation level, the STI-PA and the SPC token — is essential before a provider can talk about caller-ID authentication accurately.
What the STIR/SHAKEN ecosystem can involve
Depending on a provider's role, its caller-ID authentication setup can involve:
- ✓a STIR/SHAKEN digital certificate
- ✓A, B or C attestation levels
- ✓the Secure Telephone Identity Policy Administrator (STI-PA)
- ✓a Service Provider Code (SPC) token
- ✓an authorized Certification Authority (STI-CA)
- ✓a SIP Identity header carrying signature data
- ✓terminating-provider signature verification
- ✓Robocall Mitigation Database certifications
02What Is a STIR/SHAKEN Certificate?
A STIR/SHAKEN certificate is a digital certificate used within the STIR/SHAKEN caller-ID authentication framework to support cryptographic signing and verification of telephone calls. It allows a recipient to verify that a call signature was created by an authorized signer.
A provider has a private key, a public key, and a certificate that binds the public key to an authorized identity within the trust framework. The private key must be protected; the public certificate allows another participant to verify the signature.
What Is a Digital Certificate?
A digital certificate is a cryptographic credential associated with a trusted entity. In STIR/SHAKEN, certificates allow a recipient to verify that a call signature was created by an authorized signer. The basic concept is similar to other public-key cryptography systems.
03STIR vs SHAKEN & Digital Certificates
The two names describe related parts of the same ecosystem, and in practical discussions the two are usually combined as "STIR/SHAKEN." The framework operates through SIP signaling and digital signatures.
| Term | What it is |
|---|---|
| STIR | The standards framework for Secure Telephone Identity Revisited caller-identity authentication. |
| SHAKEN | The industry implementation framework — Signature-based Handling of Asserted information using toKENs — used by service providers. |
What a certificate is built from
A provider's cryptographic setup generally includes:
- ✓a private key, kept secure by the provider
- ✓a public key, shared for verification
- ✓a certificate binding the public key to an authorized identity
- ✓a SIP Identity header carrying the signed assertion
04Who Issues the Certificate?
The STIR/SHAKEN trust ecosystem contains different roles, and the Policy Administrator and Certification Authority are not the same function. A provider should not describe the Policy Administrator as simply "the certificate issuer" — authorized Certification Authorities issue certificates according to the applicable trust framework.
A simplified view of the trust hierarchy: governance and policy functions sit above the service provider, while an authorized Certification Authority (STI-CA) issues the certificate itself.
What Is the STI-PA?
The Secure Telephone Identity Policy Administrator, or STI-PA, performs policy and trust-framework functions. iconectiv currently operates the U.S. STI-PA role. The STI-PA is involved in the authorization and governance process that allows eligible service providers to participate in the STIR/SHAKEN certificate ecosystem. One important mechanism it administers is the Service Provider Code (SPC) token, which is associated with a provider's authorization to obtain certificates.
What Is an SPC Token?
An SPC token is not the certificate itself — it is part of the authorization process used by service providers seeking certificates. The exact implementation details depend on the current policy and technical framework, but the key point is that the SPC token and certificate serve different purposes.
The SPC token authorizes a provider to request a certificate from an authorized STI-CA; the certificate is then used to sign outbound calls.
05How a STIR/SHAKEN-Signed Call Works
Consider a simplified call: a customer dials a number and the originating provider receives the call. The provider determines whether it can authenticate the calling party and the telephone number, and if eligible, generates a STIR/SHAKEN signature.
The actual network architecture can be more complex, particularly where calls pass through multiple carriers or gateways.
What the terminating provider does
The terminating provider receives the call, examines the STIR/SHAKEN Identity information and verifies the signature. It can then use that authentication information as part of its call-handling decisions — decisions that interact with analytics, reputation, fraud controls, robocall mitigation, customer preferences, carrier policy and regulatory requirements. STIR/SHAKEN therefore forms one part of a broader call-trust ecosystem.
Not every call necessarily has the same authentication circumstances. Calls can travel across IP networks, TDM networks, international gateways, legacy systems and providers with different capabilities, and there are also regulatory exceptions and implementation circumstances. A call without a STIR/SHAKEN signature should not automatically be described as fraudulent, and a signed call should not automatically be described as trustworthy — authentication provides information that can support downstream decision-making.
06A, B & C Attestation Levels
A — Full Attestation
The strongest of the three standard attestation levels. It generally indicates that the originating provider can authenticate the customer making the call, establish that the customer is authorized to use the calling number, and sign the call using the appropriate STIR/SHAKEN process. This does not mean the call is guaranteed to be legitimate — attestation is a statement about the provider's relationship to the caller identity, not a "good caller" certificate.
B — Partial Attestation
Applies when the originating provider can establish some but not all of the relationships required for Full Attestation. For example, the provider may know its customer but may not have sufficient authority to verify that the customer is authorized to use the specific calling number. The exact interpretation depends on the applicable framework.
C — Gateway Attestation
Associated with gateway situations where the provider does not have the same level of customer-identity and number-authorization relationship as a traditional originating service provider. Gateway providers may encounter calls originating outside the provider's direct customer relationship.
07Certificate vs Attestation
This distinction deserves emphasis, since it is one of the most important technical corrections in telecom content: a certificate is not the same thing as attestation, and they should not be described interchangeably.
| Component | What it is |
|---|---|
| Certificate | A cryptographic credential used for signing and verification. |
| Attestation | An assertion about the originating provider's relationship to the caller identity. |
| SPC Token | An authorization mechanism associated with obtaining a certificate. |
| STI-PA | Policy and trust-framework administrator (iconectiv in the U.S.). |
| STI-CA | Authorized Certification Authority that issues the certificate. |
Why CLI management matters
Caller ID (CLI) management is central to STIR/SHAKEN. A provider should know:
- ✓which numbers its customers are authorized to use
- ✓which DIDs belong to which accounts
- ✓which numbers are ported or assigned
- ✓which numbers may be used as outbound CLI
- ✓which traffic comes from upstream carriers
A provider that cannot establish a customer's authority to use a telephone number may not be able to provide the same level of attestation as a provider with complete verified information.
STIR/SHAKEN and VoIP resellers
Reseller environments can be complicated: a reseller may acquire customers, provide a softphone or PBX, assign DIDs, and use an upstream carrier for termination — where the upstream carrier performs the actual signing. That means the reseller and carrier should have clear contractual and operational responsibilities.
Questions worth resolving up front include:
- ✓Who verifies customers?
- ✓Who verifies DIDs?
- ✓Who signs calls?
- ✓Who manages the certificate?
- ✓Who handles traceback?
- ✓Who maintains RMD information?
- ✓Who handles fraudulent traffic?
- ✓Who owns the customer relationship?
08Common STIR/SHAKEN Mistakes
Calling A attestation a certificate
They are separate concepts — a certificate signs the call, attestation describes the provider's relationship to the caller.
Saying STIR/SHAKEN guarantees calls are legitimate
It does not. Authentication provides information; it does not vouch for caller intent.
Treating the certificate and SPC token as the same thing
They are different — the SPC token authorizes a provider to obtain a certificate.
Assuming every call receives A attestation
Attestation depends on the provider's ability to authenticate the customer and calling number.
Ignoring caller-ID authorization
A provider needs reliable records of which customers can use which numbers.
Treating STIR/SHAKEN as the entire robocall mitigation program
It is one important component alongside RMD certification and other controls.
Publishing outdated requirements
The FCC continues to update caller-ID authentication and robocall mitigation rules.
09Why It Matters to NexGen Voice
For a company operating in VoIP, SIP trunking, DID numbers and wholesale telecommunications, caller-ID authentication is relevant because carrier relationships and call-treatment decisions increasingly depend on accurate STIR/SHAKEN implementation. When discussing NexGen's use of STIR/SHAKEN publicly, wording should remain technically precise.
What should a provider have in place?
A professional VoIP provider should consider maintaining:
- ✓customer KYC and verification records
- ✓telephone-number assignment and CLI authorization records
- ✓fraud and traffic monitoring
- ✓upstream-carrier records
- ✓STIR/SHAKEN signing procedures and certificate management
- ✓private-key security
- ✓traceback and robocall mitigation procedures
- ✓current RMD information
10Frequently Asked Questions
It is a digital certificate used within the STIR/SHAKEN trust framework to support cryptographic signing and verification of caller-ID information.
No. A attestation is an assertion associated with a call. The certificate is the cryptographic credential used for signing.
A represents Full Attestation, B Partial Attestation, and C Gateway Attestation within the STIR/SHAKEN framework.
iconectiv currently operates the U.S. STI-PA function.
It is part of the STIR/SHAKEN authorization process used by service providers when obtaining certificates.
No. It is designed to improve caller-ID authentication and trust but does not eliminate all fraudulent or unwanted calls.
No. Authentication provides information about the provenance and handling of the asserted caller identity, not a guarantee of legitimacy.
Because the originating provider's relationship with the customer and telephone number affects the attestation that can appropriately be applied.
Not necessarily. STIR/SHAKEN is primarily associated with the applicable U.S. caller-ID authentication ecosystem, and international or gateway scenarios can differ.
The FCC's robocall mitigation framework connects STIR/SHAKEN implementation with broader provider obligations, including certifications submitted to the Robocall Mitigation Database.
11Conclusion
STIR/SHAKEN is a technical trust framework designed to improve confidence in caller-ID information. For VoIP providers, the most important concepts to keep separate are the STI-PA, the SPC token, the STI-CA, the digital certificate, the STIR/SHAKEN signature, and A/B/C attestation. These components work together but are not interchangeable.
A certificate provides cryptographic credentials. The call carries authentication information. Attestation communicates the originating provider's relationship to the caller identity. The receiving network verifies the signature.
For NexGen Voice and other professional VoIP providers, accurate customer verification, number authorization, fraud controls and carrier relationships are therefore as important as the technical signing process itself.
Further reading from authoritative sources: FCC, USAC and the iconectiv STI-PA resources.
.webp)
