Russia Is Developing National Certificates for Software Code
The Ministry of Digital Development has drafted rules for issuing national certificates to sign software. The system will allow users to verify where applications came from and track changes made to their code after release.
The new mechanism is intended to reduce Russian developers’ reliance on foreign certificate authorities. A certificate will work like a software passport: if an application has no signature or the system detects an unfamiliar certificate, users will be warned of the potential risk. The system is scheduled to launch on March 1, 2027, and the certificates will be valid only within Russia.
The National Certification Authority (NCA) under the Ministry of Digital Development will issue the certificates. The agency already issues certificates for websites, a practice that expanded after foreign certificate authorities began revoking certificates issued to Russian companies. The draft rules provide for 11 certificate profiles, but Microsoft, Apple and Google do not recognize the NCA as a trusted authority, so the certificates will not help developers publish applications on the App Store or Google Play.
The system will not initially be mandatory for all software, but the law already gives the government authority to impose the requirement for government procurement and critical infrastructure facilities. Meanwhile, Astra, SberTech, CryptoPro and other companies are developing their own solutions. Under the law, however, only the state-run NCA will be authorized to issue national certificates.
