The National Root CA and the trust chain beneath every certificate

What a root authority does

CRAN’s presentation on the technical architecture of the National Root CA, given on 14 September 2026, defines the root as the ultimate trust anchor of a country’s public key infrastructure. It establishes the highest level of cryptographic trust, signs the certificates of accredited certification service providers, builds trusted chains and gives the country sovereign control over its digital trust.

The core functions listed are to generate and protect the root keys, sign accredited provider certificates, maintain the national trust hierarchy, sign and publish revocation lists, manage the certificate lifecycle and support national and cross-border interoperability. In plain terms: a signature on a contract points to a certificate, the certificate points to the provider who issued it, and the provider points to the national root.

How the root is protected

The operating model described in the presentation is deliberately slow. The root runs offline in an air-gapped environment, with its private key held in a hardware security module. It is activated only for authorised events: signing a provider certificate, signing the root revocation list, rolling the key over, recovering from backup, and emergency revocation.

Keys are generated, activated, backed up, recovered and destroyed through formal key ceremonies with multi-person and dual control, each documented and authorised. Trusted roles are separated among administrators, security officers, key custodians, system administrators and auditors, so no single person controls a critical operation. Public services such as the repository and revocation list distribution stay logically and physically apart from the offline root, and every ceremony and signing event is logged and open to independent audit.

The lifecycle for a subordinate certificate runs through application, verification, approval, signing, acceptance, publication, monitoring and re-key or revocation. Governing documents are the Certificate Policy, the Certification Practice Statement, security policies and standard procedures.

Who needs accreditation and who does not

A second CRAN presentation, from the same day, sets a test. A service is a certification service when it issues certificates to subscribers, verifies advanced electronic signatures with subscriber certificates, suspends or revokes certificates, confirms revocation status, issues cross-certificates, or offers related validation. The test turns on three questions. Is the service supplied to another party to prove reliability? Does it perform a certification function? Is recognised status claimed?

If the answers point to certification, a Namibian provider applies for accreditation. A foreign provider applies for recognition, shows home authorisation and compliance, and appoints a local agent. An organisation, subscriber or relying party does not apply on the provider’s behalf. A party which only validates a certificate path for its own decision is a relying party. Under CRAN’s test, such a party needs nothing, but it should check the provider in the register before relying on recognised status.

An applicant must submit its Certificate Policy and Certification Practice Statement, technical and security specifications, an incident management plan and a business continuity plan which covers key loss or compromise and names the recovery team. Providers must keep an up-to-date revocation list for their subscribers’ certificates. Offences relating to unaccredited services carry a fine of up to N$50,000, imprisonment, or both.

The regularisation period and what did not change

The same legal presentation explains how the law treats arrangements made before the new rules began. Parties are permitted to continue their agreed electronic signature arrangements, subject to ordinary validity and evidential requirements. Existing contracts continue. The change lies in the claim of equivalence: for an electronic signature to carry the evidentiary weight of a handwritten one, it must be provided by an accredited certification service provider. Where a law specifically requires a recognised electronic signature, the supporting certificate must come from an accredited or recognised provider.

A provider, certificate or product cannot be marketed as recognised before CRAN grants approval, and a provider must be accredited to supply accredited security products and recognised signatures. Existing providers have twelve months, from the date CRAN will provide, to apply. CRAN describes this as a regularisation period for every entity to apply, and it targets a decision within 90 business days of a complete application. The presentation also lists appeals and reconsideration mechanisms for accreditation decisions, and alignment with international and ISO standards to support cross-border interoperability and mutual recognition.

Questions to put to a signature or trust vendor

A buyer of electronic signature software uses CRAN’s framework as a checklist. Does the vendor issue certificates to signers, or only apply a signature drawn or typed on screen? If it issues certificates, is it accredited or recognised, and where is it listed on CRAN’s register? Where is the signing key held, and who is allowed to use it? How are certificates suspended and revoked, and where is the revocation list published? What evidence does a signed document carry: timestamp, signer identity checks, audit trail?

The answers sort products into three groups. Some are basic signature tools, suitable for many internal and commercial uses, with a clear statement of what they prove. Some are advanced signature tools, which add uniqueness to the signer and tamper detection. A few are recognised, because a provider behind them is accredited. A buyer should match the group to the transaction, and a vendor which blurs the groups in its marketing is a risk in itself.

The four tiers

The architecture diagram in the same presentation draws four tiers. Tier 1 is the offline National Root CA, the trust anchor. It issues and signs certificates to accredited certification service providers only. It sits in a secure, air-gapped facility containing a hardened, dedicated root server, a hardware security module certified to FIPS 140-2 or 140-3 Level 3 for key generation and cryptographic operations, an administration workstation with no internet access, encrypted and securely stored backups with key wrapping, and secure media for moving data in and out. An offline disaster recovery site holds an up-to-date encrypted backup. A separate, online publication infrastructure serves the root certificate repository, the root revocation list, an optional online certificate status responder and the policy repository.

Tier 2 is the set of accredited certification service providers, also called issuing authorities. Each is accredited by CRAN, runs online in a secure environment, is permitted to operate subordinate authorities and issues certificates to subscribers. The diagram lists their duties: certificate issuance, publication of revocation lists and status responses, subscriber management, key and certificate lifecycle, and security and compliance. Tier 3 is subscribers: individuals, government entities, businesses, devices, and applications and systems. Tier 4 is relying parties, which rely on certificates to establish trust and validate the certificate path to the National Root CA: government services, financial institutions, businesses and enterprises, citizens and others.

Six pillars of protection

A second diagram lists six pillars which CRAN says ensure the root operates with integrity, security and accountability. Governance covers the policy documents, defined roles, risk management and compliance with regulations and standards. The offline root server is air-gapped, on dedicated hardware, with a hardened operating system, used only for cryptographic operations and with no network connectivity. The hardware security module and key management pillar covers key generation, storage and ceremony, key lifecycle, dual control for all key operations, and no exposure or export of private keys.

Access control and audit logs call for multi-factor authentication, role-based access, separation of duties and least privilege, and comprehensive audit logging with tamper-evident records. Physical security lists guard-controlled facility access, biometric access and CCTV, a secure enclave and data centres, environmental controls for power, cooling and fire suppression, and a visitor management and escort policy. Disaster recovery and business continuity cover a documented plan, secure backups, a secondary site, regular tests and drills, and continuity of key services such as revocation list publication.

Dual control and separation of duties recur across the pillars, so no single person acts alone on a critical operation. Visitor management appears on the list too: the most secure room in the national digital trust system still records who enters and who escorts them.

Where the programme stands, by CRAN’s own slide

An implementation journey slide shows seven stages with their status. Policy and governance: completed, with a PKI governance framework and defined roles and mandates. Legislation and regulation: completed, with the electronic signature regulations finalised and the accreditation regulations operationalised. Root CA and trust infrastructure: completed, with the root set up and secured and testing and site acceptance completed. Accreditation of certification service providers: ongoing, with the first provider accredited, MHAISS, for the purpose of rolling out electronic identity documents, and onboarding and assessment of further providers continuing. Adoption and integration: completed, enabling government-first use cases such as electronic identity, signatures and services. Go live: completed, launching trusted services and electronic identity. Sustain, assure and evolve: ongoing.

The legal foundations slide names four instruments: the Communications Act, 2009, the Electronic Transactions Act, 2019, the Regulations Regarding Accreditation of Security Products and Services and Providers of Such Products and Services, 2026, and the eSignature Regulations, 2026.

The root certificate and the public register of accredited providers are published through CRAN’s repository at rootca.cran.na. A reader relying on a provider’s status checks the register.

What this means for organisations in Namibia

Any business running software which signs, verifies or validates certificates for customers should map each function against CRAN’s six-part test and decide, in writing, whether it is a certification service.

Product claims deserve care. Words such as recognised, accredited or approved by the Authority carry legal weight, and the Act treats unfounded use as an offence. Say what the product does, not what status it hopes to have.