Russia's MinTsifry to Begin Issuing State Code Signing Certificates in 2027

The Russian Ministry of Digital Development, known as MinTsifry, has announced plans to start issuing official code signing certificates to Russian developers beginning in 2027. Corporate security certificates are scheduled to follow in 2028. These certificates will allow operating systems to identify software publishers and verify that code has not been altered after release. The ministry will act as the National Certification Center, setting requirements, issuing and revoking certificates, determining validity periods, and maintaining a public registry. While the signature confirms origin and integrity, it does not guarantee the absence of vulnerabilities. Recognition by operating systems, browsers, and app stores remains necessary, and international platforms are not obligated to trust the certificates automatically.

AntiMalwareTranslated from Russian

Read at source

Russian developers will soon receive official state-issued certificates for signing software code. MinTsifry plans to launch the issuance process in 2027, with corporate security certificates scheduled for 2028. The digital signature will enable operating systems to identify the software publisher and confirm that the code has not been modified after release.

The ministry published its intentions through Vedomosti. A draft government resolution proposes granting MinTsifry the authority of the National Certification Center. The agency will define certificate requirements, issue and revoke certificates, set validity periods, and maintain an official registry.

For end users, the benefit lies in the operating system’s ability to recognize the publisher of an installation file and display warnings about unknown developers. However, the signature only confirms origin and integrity; it does not certify that the software is free of vulnerabilities.

The law permits charging fees for certificates, but does not require it. Decisions on pricing and tariffs have not yet been made. Technical acceptance by operating systems, browsers, and application stores will also be required. Outside Russia, the certificates will not receive automatic trust, leaving the decision to individual platform owners. Developers targeting multiple markets may therefore need several different signatures.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Google to Back Unified robots.txt Standard for Blocking AI Training Data Use Starting in 2027
Rostelecom Explores Underground Data Centers in Partnership with Nornickel for Enhanced Physical Protection
Who Pays When AI Agents Err: Insurance Gaps for AI Risks Emerge in Russia and the West