VSPs and STIR/SHAKEN Certificates

If you run calls over your own network, the certificate rules around STIR/SHAKEN now reach you directly. As of June 20, 2025, every Voice Service Provider, often called a VSP, must hold its own registered STIR/SHAKEN certificate for calls that originate on its network, even when a third-party upstream provider also signs those calls. In other words, leaning on someone else's signing is no longer enough if the traffic starts with you. For anyone operating a VoIP platform, this is the STIR/SHAKEN obligation that quietly moved from optional to mandatory.

What the rule requires

A VSP is the provider whose network a call originates on. Under the rule, that provider needs its own certificate registered, not just a relationship with an upstream carrier that signs the traffic. The point is accountability: regulators want a clear, signed chain that ties each call back to the network it actually came from, so a bad actor cannot hide behind a chain of resellers. If your operation originates calls, you either become a registered VSP yourself or you originate through a provider who already is.

For most VICIdial operators, the practical answer is the second option: originate through a Carrier or hosting provider that already holds the certificates and handles signing, so you inherit proper Call attestation without standing up your own certificate infrastructure. That is exactly the arrangement we provide. This fits the larger compliance picture in our compliance overview, and it comes from the same law described in the TRACED Act.

Why did regulators close this gap? Before the rule, an originating provider could point at an upstream partner and say the calls were signed somewhere down the line. That left a blind spot: the network where a call actually started might have no certificate of its own and no direct accountability. Tightening the requirement at the point of origination does a few things at once:

• It ties every signed call to the specific network it came from, not just to whoever happened to carry it later.
• It removes the excuse of relying entirely on an upstream provider to sign on your behalf.
• It makes the chain of trust harder to fake, because a missing originating certificate now stands out.

For a call center, the takeaway is simple even if the regulation is not. You do not have to read certificate policy or stand up signing infrastructure to stay on the right side of this. You just need to make sure your calls originate on a network that is already a properly registered VSP. If you are hosted with a provider that handles this, the rule is satisfied for you and your traffic keeps earning clean signatures.

Where signing happens

sequenceDiagram
  participant D as VICIdial Dialer
  participant V as Originating VSP
  participant U as Upstream Provider
  participant T as Terminating Carrier
  D->>V: Originate call
  V->>V: Sign with own certificate
  V->>U: Hand off signed call
  U->>T: Carry signed call
  T->>T: Verify signatures

The VSP where the call originates signs it with its own certificate first, then passes it upstream. The upstream provider may add its own signing, but the originating signature is the one regulators now require.

You do not need to become your own registered VSP to stay compliant. VICIfast originates your calls through properly certificated networks so signing is handled for you. See pricing for plans.