The Association of Banks of Russia (ABR) has proposed that the Ministry of Digital Development make the installation of Russian National Certification Authority (NCA) TLS certificates mandatory for mobile devices. The initiative suggests that these certificates should be automatically installed when users download or update banking applications.
The ABR, which represents institutions holding over 90% of Russian banking assets, has outlined a broader strategy to ensure the security of digital services. Proposed measures include creating a unified installer for Windows and Linux, pre-installing certificates on devices during manufacturing, and simplifying the process for users via the Gosuslugi portal.
The association is also preparing a proposal for the Central Bank of Russia to establish cross-certification with BRICS nations and other partner countries. The plan includes creating official distribution channels for certificates with multi-language instructions to assist foreign users.
Industry experts have highlighted significant technical and security challenges. On iOS, adding a root certificate to the system storage is restricted, while on Android, installation does not guarantee universal trust across all applications. Security analysts also warn that a centralized state certificate could create a single point of vulnerability for traffic interception.