Author: Pavel Onuchin, VPN and network security specialist

12 min read

Updated: October 31, 2026

The Russian Ministry of Digital Development certificate: what it is, whether to install it and how to remove it

The Ministry of Digital Development certificate («сертификат Минцифры») is the Russian Trusted Root CA root certificate of the National Certification Authority (НУЦ, NUC). It's needed so that Chrome, Safari, Edge and Firefox open sites using Russian TLS certificates without a warning: according to our check on October 31, 2026, the sites of Sberbank, VTB, Alfa-Bank, T-Bank, PSB, Rosselkhozbank and Sovcombank run on them. Installing it isn't mandatory: Yandex Browser understands such certificates on its own, and banking apps generally work without it. The main argument against installing it is that a root certificate can vouch for the authenticity of any site, not just a bank's.

What are the Ministry of Digital Development certificate and the NUC?

The NUC is a state certification authority that since 2022 has been issuing free TLS certificates to Russian websites through Gosuslugi (the government services portal). The Ministry certificate you're asked to install is its root: a file that, once installed, makes your device trust all certificates issued by the NUC.

The chain is structured the same way as for any HTTPS site. The site presents its certificate, which was signed by the issuing authority Russian Trusted Sub CA, which in turn is signed by the root Russian Trusted Root CA. The browser trusts the site only if the root is in its store.

We downloaded the files from the Gosuslugi server and looked at what's inside:

Parameter	Russian Trusted Root CA	Russian Trusted Sub CA (2024)
Role	root	issuing; bank sites are signed with it
Validity period	01.03.2022 – 27.02.2032	15.07.2024 – 19.07.2029
Domain restriction (Name Constraints)	none	none
SHA-256 fingerprint starts with	D2:6D:2D:02	21:55:78:50

The last row will come in handy for checking a downloaded file: the root's full fingerprint ends with CA:8E:CF:31. Sber's online banking site serves the same root in its chain.

For a secure connection on other people's and public networks, we recommend BessyConnect: it's a VPN on VLESS with Reality camouflage, whose traffic looks like ordinary HTTPS. It doesn't replace the Ministry certificate; we explain why below.

Why do Gosuslugi and banks ask you to install it?

Because in summer 2026 major banks switched to NUC certificates, and Chrome, Safari, Edge and Firefox don't trust them. Without the Ministry root, such sites open with a "Your connection is not private" error.

According to «Код» (Kod) on August 5, 2026, on June 13 GlobalSign began revoking certificates from some Russian organizations, citing CA/Browser Forum rules on companies on sanctions lists. In late July and early August, banks left without international certificates switched to the NUC. TKS.RU, citing Forbes, names Sberbank, VTB, Rosselkhozbank, Uralsib, Alfa-Bank, PSB and Bank Saint Petersburg.

Sber says so directly on its error page. We opened its site in Chrome without the NUC root and got: "You may not have the certificates of the National CA of the Russian Ministry of Digital Development installed", with a link to the Gosuslugi instructions.

Gosuslugi itself, meanwhile, still runs on a foreign certificate. Here's who is signed by whom as of October 31, 2026:

Site	Who issued the certificate	Is the NUC root needed in Chrome and Safari
Sberbank, VTB, Alfa-Bank, T-Bank, PSB, Rosselkhozbank, Sovcombank	NUC of the Ministry of Digital Development	yes
Gosuslugi (www and login via ESIA)	GlobalSign, until 12.12.2026	no
mos.ru, Ozon, Raiffeisenbank	GlobalSign	no
Federal Tax Service (nalog.gov.ru), Wildberries	Let's Encrypt	no
Gazprombank	TrustAsia	no

The picture is changing: the Gosuslugi certificate expires in December, and what will replace it is unknown. On October 26, 2026, SecurityLab reported that the Association of Banks of Russia had asked the Ministry of Digital Development to make preinstallation of NUC certificates on smartphones mandatory. The ministry confirmed receipt of the request, but there's no such requirement yet.

Which browsers support Russian certificates?

Out of the box, NUC certificates are understood by Yandex Browser (since 2022) and the Chromium-GOST build. Chrome, Safari, Edge and Opera start trusting them only after the root is installed in the system, and Firefox only after the root is added to its own settings.

We checked the three main root stores on October 31, 2026: Russian Trusted Root CA is in neither the Chrome Root Store (95 roots), nor Mozilla's list, nor the macOS system store.

Browser	Trusts the NUC on its own	What you need to do
Yandex Browser	yes	nothing; according to Yandex, "there's no need to install them manually"
Chromium-GOST	yes	nothing
Chrome, Edge, Opera	no	install the root in Windows or macOS
Safari on Mac and iPhone	no	install the root, and on iPhone turn on trust
Firefox	no	add the root in Firefox's settings

According to Google's documentation, Chrome on Windows uses roots the user has added to "Trusted Root Certification Authorities", and on Mac it uses certificates from Keychain Access marked "Always Trust". So installing into the system turns on trust in all browsers based on it at once.

Do you need to install the Ministry certificate, and is it dangerous?

The law doesn't require users to install the NUC root. The decision depends on whether you need bank websites in your browser. The risk is that an installed root can vouch for the authenticity of any site, not just Russian ones.

This is visible from our check: the Ministry root has no Name Constraints extension that would limit it to .ru domains or a list of organizations. When installing any such certificate, Android itself shows a warning: "The owner of the installed certificate may be able to access your data entered on websites and in apps (for example, passwords and bank card details), even if this information is encrypted".

Specialists' assessments differ.

Against installing it on your main device. Cyber lawyer Sarkis Darbinyan, in Novaya Gazeta Europe on August 6, 2026, called the Ministry certificate a "censor" that can open a letter, and warned of the possibility of a "man-in-the-middle" attack. He advises using the bank's app, Yandex Browser or a separate device.
The risk is common to all roots. Experts in a TKS.RU review of August 5, 2026 (based on Forbes reporting) call the possibility of broad trust a property of any root certificate infrastructure, not a peculiarity of the NUC. HTTPS encryption with a Russian certificate is preserved.
The industry's position. Ilya Shibanov, head of Yandex Browser, said in a comment to «Код» on October 7, 2026, that national certificates "are becoming part of a new trust infrastructure".

There's also a precedent. In 2019, ISPs in Kazakhstan asked subscribers to install a government root certificate, and Mozilla wrote on its blog on August 21, 2019, that it allowed traffic to be intercepted and decrypted. Firefox and Chrome blocked that certificate at the time. We were unable to find public evidence of the NUC root being used this way as of October 31, 2026, but the technical capability of any root is the same.

A practical compromise that both sides recommend: don't install the root "just in case", but open your banks in their app or in a separate browser.

How to install the Ministry certificate on iPhone, Android and a computer?

Download the files only from the gosuslugi.ru/crt page: according to «Код», it has instructions for Windows, macOS, Linux, Android and iOS. The Ministry of Digital Development, according to TKS.RU, specifically warned in July 2026 against taking certificates from third-party sites. After downloading, check the root's fingerprint against the table above.

iPhone and iPad

Open the certificates page in Safari, download the profile for iOS and tap "Allow".
In Settings, open "Profile Downloaded" and install it.
Go to Settings → General → About → Certificate Trust Settings.
Turn on full trust for Russian Trusted Root CA. According to Apple's support article, trust for TLS isn't turned on automatically for manually installed profiles.

Android (menu items per Google's help for Pixel; names may differ on other brands)

Download the root certificate file.
Open Settings → Security & privacy → More security & privacy → Encryption & credentials → Install a certificate.
Choose "CA certificate", read the warning and tap "Install anyway".
Select the downloaded file. If the phone has no PIN or password, the system will ask you to set one.

Windows

Download the root and issuing certificates and open the root certificate file.
Click "Install Certificate" and choose "Current User".
Select "Place all certificates in the following store" and specify "Trusted Root Certification Authorities".
Repeat for the issuing certificate and restart the browser.

Mac

Double-click the downloaded file; it will be added to Keychain Access.
Open the certificate, expand the "Trust" section and choose "Always Trust".
Confirm with your Mac password and restart the browser.

Firefox, according to «Код», may require a separate import of the root in its own settings. If you added the root there, you'll have to remove it in Firefox too.

How to remove the Ministry certificate?

You can remove it at any time; it's reversible. After removal, bank sites on NUC certificates will again show an error in Chrome and Safari, but banking apps and Yandex Browser will keep working.

Device	Where to remove it
iPhone, iPad	Settings → General → VPN & Device Management → the Ministry profile → "Remove Profile". To just turn off trust, switch off the toggle in "Certificate Trust Settings"
Android	"Encryption & credentials" → "Trusted credentials" → "User" tab → Russian Trusted Root CA → "Remove"
Windows	Win+R → certmgr.msc → "Trusted Root Certification Authorities" → "Certificates" → Russian Trusted Root CA → "Delete"
Mac	Keychain Access → search for "Russian Trusted" → delete both certificates

Android also has a "Clear credentials" button: according to Google's help, it removes all user certificates at once and leaves system ones alone. But along with the Ministry root, it will also remove your work Wi-Fi certificates, if you have any.

The Ministry certificate and VPNs: will a VPN help open a bank's site?

No. The "Your connection is not private" error is generated by the browser itself when it can't find the root in its store, and which network the traffic goes through doesn't matter for this check. A VPN doesn't replace the certificate, and the certificate doesn't interfere with a VPN.

The connection between them is different. A site's certificate can only be substituted along the traffic's path. While the connection goes through a VPN tunnel, your ISP and TSPU equipment see only an encrypted tunnel to the server; more on this in the article what your ISP can see. But many VPNs route Russian sites outside the tunnel, which means the bank opens directly at that moment.

If a bank won't let you in for some other reason, it's no longer about the certificate. Banks refuse access from foreign addresses or restrict logins via VPN: the causes and solutions are covered in the articles bank won't let you in with a VPN and Sberbank Online abroad.

Why we recommend BessyConnect

For a secure connection on other people's networks, we recommend BessyConnect. It's a ready-made app: the servers are already inside, you don't need to look for keys, and the decision about the Ministry root remains separate and entirely yours.

VLESS with Reality camouflage. The traffic looks like ordinary HTTPS, and the connection holds up against DPI.
More than 100 servers, so you can switch servers if one works poorly.
No logs are kept, and registration isn't required.
There's a trial period to check how it works on your network.

Apps are available for iPhone, iPad, Mac, Apple TV, Android and Android TV:

iPhone, iPad, Mac and Apple TV — App Store
Android — Google Play
Android TV — Google Play
All platforms — download page

The limits are as follows. BessyConnect doesn't fix the certificate error on bank sites: for that you need the NUC root, Yandex Browser or the bank's app. It doesn't protect you from a root that's already installed in the system if the traffic goes outside the tunnel. There's no Windows app. BessyConnect isn't in the Russian App Store either; on iPhone it's installed with an Apple Account from another country.

If you need an encrypted connection on iPhone, Mac or Android without extra certificates in the system, start with BessyConnect: all versions are collected on the download page.

Frequently asked questions

Is it mandatory to install the Ministry certificate? No, the law doesn't require it. On October 26, 2026, the Association of Banks of Russia proposed making preinstallation on smartphones mandatory, but there's no such requirement yet.

Do I need the Ministry certificate for the Sberbank or VTB app? Usually not: experts quoted by Novaya Gazeta Europe say that a bank's official app generally doesn't require a system certificate. This is consistent with Android's documentation: apps targeting Android 7.0 and later don't use user-installed certificates by default.

Can I remove the Ministry certificate? Yes, at any time: on iPhone via "VPN & Device Management", on Android via "Trusted credentials" → "User", on Windows via certmgr.msc. After that, bank sites on NUC certificates will again only open in Yandex Browser or the bank's app.

How can I check that I've downloaded the genuine certificate? Open the file's properties and check the SHA-256 fingerprint: for Russian Trusted Root CA it starts with D2:6D:2D:02 and ends with CA:8E:CF:31, and it's valid until February 27, 2032.

Will BessyConnect help if a bank's site says "Your connection is not private"? No, that error is fixed by the NUC root, Yandex Browser or the bank's app. BessyConnect is for something else: a secure connection on VLESS with Reality camouflage, more than 100 servers and a trial period to test it on your network.

Sign In