I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they care about certificates. So my question is:

What are the most recognized, most valuable certificates that a web application must have?

In short, about the project and technical details:

• .NET 4.5
• CMS SaaS based on Azure
• Users will be able to input a vide variety of data (uploading files as well)
• Users will be able to create their own plugins/modules
• It will eventually be open sourced (not soon tho)

Also, I'm interested in the certification procedure, how does it work? I imagine I'll have to get the whole application pen-tested, so who does the pen-testing, certificators?

Thanks!

This is my first post on security.stackexchange, so don't be too harsh on me :).