How can I verify a client's identity by requesting a digital certificate? So I am registering users and I need to know they really are who they say they are. More importantly that they represent the company they say they represent.

I was told I can ask them to send me a verisign (or similar) certificate. Basically the company (the more reputable ones) emiting certificates are meant to have already made sure that person is who he says he is and/or really works for Company X Inc.

So when a user fills in his registration form, I ask for an email address, name, company name,etc. and I also ask for this certificate to be uploaded (with a short list of the actual certificates I will accept, e.g. Verisign Pro EV.)

So how do I then use this file to verify that the certificate is valid?
Ok, I'll assume you have collected the data from the form. The next step is to confirm the user's identities based on the certificates they have. For this you have two options: 


Send a S/MIME signed email to you which includes a chosen-by-you challenge in the message body. For this you could randomly generate a new email adress for each user so you can distinguish them if two happen to share some information. Also make sure that this random email address is in the message body because only that gets signed. Once you receive the email, you verify the certificate signatures, verify the root CA and the intermediates, verify the signature on the mail and verify the information in the certificat against what you had on the form for this specific person. If everything passes this person is confirmed. This assumes the user can use their certificate for e-mail signing.
Run a TLS client authentication. For this you'd give each user a random link when he has completed the form. Next he opens that link, the web-server will trigger a TLS client authentication and the TLS protocol will verify that the user has a) access to the private key of the certificate, b) will take care of all the signature verifications and whatnot and c) will verify that the cert chains up to a trusted root that you explicitely set up to accept for the client authentication. Following that your application-layer should get access to the client certificate information from your TLS implementation and need to verify that all the fields in the certificate match with the expected values from the form. This assumes the user's certificate is configured to be used with the browser which is (usually?) less common.





  So how do I then use this file to verify that the certificate is
  valid?


You don't without interaction. The certificate was issued to the holder of the private key associated with the public key in the certificate. This person is guaranteed to be the person from the certificate. If you just have the certificate you don't know that the person uploading it is in possesion of the secret key and thus you don't know whether this is indeed the "legitimate owner" of the certificate, thus you need one of the above approaches (which both shouldn't be too hard to implement).