Circular No. 17/2025/TT-BKHCN stipulates technical requirements for interconnection with the National Electronic Authentication Center

CIRCULAR

TECHNICAL REQUIREMENTS FOR INTEROPERABILITY WITH THE NATIONAL ELECTRONIC CERTIFICATION CENTER

NATIONAL E-CERTIFICATION CENTER

On the basis of Law on Electronic Transactions No. 20/2023/QH15;

On the basis of Law on ENACTMENT OF LEGAL DOCUMENTS No. 64/2025/QH15 amended and supplemented by Law No. 87/2025/QH15;

Decree No. Decree No. 68/2024/NĐ-CP June 25, 2024, of the Government on specialized digital signatures for public service;

Decree No. Decree No. 23/2025/NĐ-CP February 21, 2025, of the Government on electronic signatures and trust services;

Decree No. Decree No. 55/2025/NĐ-CP March 2, 2025, of the Government on the functions, tasks, powers, and organizational structure of the Ministry of Science and Technology;

AT THE SUGGESTION OF THE DIRECTOR OF THE NATIONAL ELECTRONIC CERTIFICATION CENTER;

The Minister of Science and Technology issues this Circular to stipulate technical requirements for interoperability with the National Electronic Certification Center.

Article 1. Scope of Regulation

This Circular stipulates technical requirements for the interoperability of the National Electronic Certification Center with organizations providing public key infrastructure (PKI) services, with organizations providing specialized PKI services for public service; updating the status of foreign electronic signature certificates into the trust service certification system.

Article 2. Scope of Application

This Circular applies to the following entities and individuals:

1. National Electronic Certification Service Providers.

2. Organizations providing specialized PKI services for public service.

3. Organizations providing PKI services for the public.

4. Foreign organizations providing electronic signature certification services recognized in Vietnam; agencies, organizations, and individuals using foreign electronic signatures and certificates recognized in Vietnam.

5. Other related agencies, organizations, and individuals.

Article 3. Definitions

In this Circular, the following terms are understood as follows:

1. "Original certificate of the organization providing specialized PKI services for public service" means the certificate issued by the organization itself.

2. "Specialized PKI certificate" means the certificate issued by the organization providing specialized PKI services for public service to its subscribers.

3. "Cross-recognition model" refers to the interoperability model between two organizations providing PKI services, where agencies, organizations, and individuals using certificates issued by one organization trust the original certificates of the other organization and vice versa.

4. "List of trusted original certificates of the National Electronic Certification Center and the organization providing specialized PKI services for public service" includes the original certificates of the National Electronic Certification Center and the original certificates of the organization providing specialized PKI services for public service.

5. "Trusted list" is a collection of foreign electronic signature certificates that have been and are currently recognized in Vietnam.

6. "Trusted list model" is a model serving to check the status of foreign electronic signature certificates and signatures within the trusted list.

7. "Information system for interoperability between the National Electronic Certification Center and the organization providing specialized PKI services for public service" is a set of hardware, software, and databases used to ensure the verification of the validity of specialized PKI signatures and the publication of the list of trusted original certificates of the National Electronic Certification Center and the organization providing specialized PKI services for public service.

8. "Trust service certification system" is a set of hardware, software, and databases used to publish the trusted list and update the status of foreign electronic signature certificates recognized in Vietnam. The trust service certification system is managed and operated by the organization providing national electronic certification services.

Article 4. Technical Requirements for Interoperability Between the National Electronic Certification Center and Organizations Providing PKI Services for the Public and Specialized PKI Services for Public Service

1. The information system must ensure the verification of the status of electronic signature certificates, PKI certificates, and the validity of signatures, specifically:

a) The interoperability between the National Electronic Certification Center and the organization providing PKI services for the public according to the method where the organization providing national PKI services issues certificates to the organization providing PKI services for the public as stipulated in Article 4 of Decree No. 23/2025/NĐ-CP dated February 21, 2025, of the Government on electronic signatures and trust services (hereinafter referred to as Decree No. 23/2025/NĐ-CP);

b) The interoperability between the National Electronic Certification Center and the organization providing specialized PKI services for public service according to the cross-recognition model.

2. The information system for interoperability between the National Electronic Certification Center and the organization providing PKI services for the public and the organization providing specialized PKI services for public service must have tools and measures to protect data and verify data during the connection process, specifically including the following contents:

a) A user interface for publishing the list of trusted original certificates of the National Electronic Certification Center and the organization providing specialized PKI services for public service, and the certificates of the organization providing PKI services for the public operating 24/7; with mechanisms ensuring access control to the system and preventing unauthorized modifications;

b) Secure management and storage of the list of trusted original certificates of the National Electronic Certification Center and the organization providing specialized PKI services for public service, and the certificates of the organization providing PKI services for the public, ensuring the accuracy and integrity of data during the exchange of information for interoperability;

c) Compliance with legal regulations on personal data protection, data verification provisions under Article 20 of the Data Law 60/2024/QH15, and other relevant legal provisions.

3. Technical conditions serving interconnection and connection for providing information to check the status of digital signature certificates and verify the validity of digital signatures, specifically as follows:

a) The list of trusted root digital signature certificates of the National Electronic Certification Center and organizations providing specialized government digital certification services, and digital signature certificates of organizations providing public digital certification services shall be fully and accurately published on the interface prescribed at point a, Clause 2, Article 3 of this Decree;

b) Information fields in the root digital signature certificates of organizations providing specialized government digital certification services must comply with the standard catalog and mandatory technical requirements applicable to the specialized government digital certification system; information fields in the root digital signature certificates of the National Electronic Certification Center and organizations providing public digital certification services must adhere to technical requirements and standards according to the regulations of the Ministry of Science and Technology.

Article 5. Technical requirements for updating the status of foreign digital signature certificates into the Trusted Service Certification System

Technical requirements for updating the status of foreign digital signature certificates into the Trusted Service Certification System are stipulated as follows:

1. The model for updating the status of foreign digital signature certificates into the Trusted Service Certification System is a trusted list model serving the verification of the status of digital signature certificates and digital signatures, and verifying the validity of digital signatures as prescribed in Clause 1, Article 30 of Decree No. 23/2025/NĐ-CP.

2. The Trusted Service Certification System used to update the status of foreign digital signature certificates must have tools and measures to protect data and authenticate data during the status update process, specifically:

a) Having a publication interface for the trusted list operating 24/7; having a mechanism to ensure system access control and prevent unauthorized modification;

b) Safely managing and storing the trusted list to ensure the accuracy and prevention of unauthorized modification of data during information exchange for interconnection;

c) Compliance with legal regulations on personal data protection, data verification provisions under Article 20 of the Data Law 60/2024/QH15, and other relevant legal provisions.

3. Information fields in foreign digital signature certificates recognized in Vietnam must comply with standards and specifications according to the regulations of the Ministry of Science and Technology to serve the verification of the status of digital signature certificates and digital signatures, and verifying the validity of digital signatures as prescribed in Clause 3, Article 30 of Decree No. 23/2025/NĐ-CP.

Article 6. Implementation Organization

1. For the National Electronic Certification Center

a) Taking the lead and coordinating with organizations providing specialized government digital certification services to guide the implementation of regulations regarding information fields in digital signature certificates of subscribers; ensuring accurate and secure exchange of trusted root digital signature certificates between the National Electronic Certification Center and organizations providing specialized government digital certification services;

b) Managing and operating the information system of the National Electronic Certification Center to serve interconnection between the National Electronic Certification Center and organizations providing specialized government digital certification services;

c) Publishing the list of trusted root digital signature certificates of the National Electronic Certification Center on the electronic information website https://www.rootca.gov.vn;

d) Establishing, publishing, and updating the trusted list of foreign digital signature certificates recognized in Vietnam when there are changes;

đ) Reviewing and submitting to the Ministry of Science and Technology for updating and issuing the list of trusted root digital signature certificates when there are changes in the trusted root digital signature certificates of the National Electronic Certification Center and organizations providing specialized government digital certification services.

2. For organizations providing specialized government digital certification services:

a) Implementing guidance on information fields in specialized government digital signature certificates;

b) Managing and operating the information system of organizations providing specialized government digital certification services to serve interconnection between the National Electronic Certification Center and organizations providing specialized government digital certification services;

c) Publishing the list of trusted root digital signature certificates of organizations providing specialized government digital certification services on the electronic information website https://ca.gov.vn.

3. Organizations providing public digital certification services are responsible for implementing regulations regarding information fields in public digital signature certificates.

4. Organizations providing foreign digital certification services recognized in Vietnam and subscribers using foreign digital signatures and foreign digital signature certificates recognized in Vietnam are responsible for directly or online updating the status of foreign digital signature certificates into the Trusted Service Certification System according to the technical guidelines of the organization providing national digital certification services and using the recognized foreign digital signature certificates within their authorized scope and purposes.

5. Agencies, organizations, and individuals developing software using digital signatures are responsible for implementing regulations concerning the digital signing function, verifying the validity of digital signature certificates, and digital signatures of applications using digital signatures according to technical requirements for digital signature software and digital signature verification software issued by the Ministry of Science and Technology.

Article 7. Provisions for Implementation

1. This Circular takes effect from the date of issuance.

2. Circular No. 04/2019/TT-BTTTT dated July 5, 2019, of the Minister of Information and Communications, which stipulates interconnection between organizations providing national digital certification services and organizations providing specialized government digital certification services, shall cease to be effective from the date this Circular takes effect.

3. The Director of the Office, the Head of the Department of Economy and Society, the Director of the National Electronic Signature Certification Center, the Heads of organizations providing specialized public service digital signature certification services, organizations providing public digital signature certification services, organizations providing foreign electronic signature certification services recognized in Vietnam, the Heads of agencies and units under the Ministry, and related individuals are responsible for implementing this Circular.

4. During the implementation process, if there are difficulties or obstacles, agencies, organizations, and individuals shall promptly reflect them to the Ministry of Science and Technology for consideration and resolution./.