Russia to Issue Code-Signing Certificates for Software in 2027

Russia's Ministry of Digital Development (Mintsifry) plans to begin issuing code-signing certificates to developers of Russian software in 2027, and corporate security certificates in 2028, a ministry representative said.

A code certificate identifies the developer of a program and lets users verify that it was not altered after release. The data is shown in the program's installation file, so an operating system can recognize the publisher and warn the user if the software comes from an unknown company.

The ministry takes over the national certification authority

A draft government resolution would give Mintsifry the powers of the National Certification Authority (NUC). The ministry would set certificate requirements, issue and revoke them, define validity periods, generate keys and maintain a registry. The NUC itself was created by Law No. 210-FZ, which takes effect on 1 March 2027. Until now its functions were effectively performed by the ministry's Voskhod research institute, and the draft does not say whether it will remain the technical operator.

Certificates are currently free only for websites, via the Gosuslugi portal. Owners of information systems can already apply there too. The law allows fees for all certificate types, but does not oblige the NUC to charge. A draft ministry order says government bodies, municipalities, the Central Bank and organizations on a government list would get certificates free. No tariff, fee decision, issuance time or validity period has been set.

Commercial certification authorities charge roughly 2,000 to 5,000 rubles per certificate, and one industry expert expects ministry prices to be similar. Nikita Novikov of TCI's certification center said the ministry combines regulatory power with service provision, so transparent tariffs, deadlines and an appeals procedure are needed. He also questioned a mandatory paid service for firms with no need for it.

Open questions

Experts say the certificates must reach the trusted stores of Russian operating systems, browsers and app stores, and that technical profiles and a timestamp service are required. Closed networks will need offline access to revocation lists.

Foreign platforms remain a problem: they alone decide whether to recognize Russian certificates, so exporters will have to support several signatures. The role of the industry certification center OTUC, which IT firms have tested since last year, is also unclear, as the law allows it only to accept developers' applications.