A Legal Guide to Starting a Certification Authority Business in Vietnam

Digital signature is a tool that helps exchange data between individuals, organizations, and the State more quickly; this solution both ensures legality and maximizes time and cost savings. Especially thanks to digital signatures, signing documents can take place anywhere, unaffected by geographical distance. Accordingly, in Vietnam, the use and registration of digital signatures has become a mandatory requirement in many fields, especially tax, social insurance… Stemming from that demand, the need to set up a digital signature certification service business company is increasingly attracting the attention of many investors. Below, Viet An Law will provide information to customers about how to set up a digital signature certification service business company.

What is digital signature certification / Certification Authority (CA) service?

Based on Article 29 of the Law on Electronic Transactions 2023, public digital signature certification service is one of the types of trust services.

Public digital signature certification service is a conditional business investment sector, therefore, organizations providing public digital signature certification services must have a service business license granted by the Ministry of Science and Technology.

Organizations providing public digital signature certification services are allowed to perform the following activities:

• Issuing public digital signature certificates to confirm and maintain the validity status of public digital signature certificates of data message signers;
• Revoking public digital signature certificates;
• Checking the validity of public digital signatures and maintaining the validity status of public digital signature certificates; not using technical or technological barriers to limit the checking of public digital signature validity;
• Providing necessary information to certify public digital signatures;
• Interconnecting with the national electronic certification service provider to ensure the checking of public digital signature validity.

Conditions for licensing public digital signature certification services

Based on Article 29 of the Law on Electronic Transactions 2023 and Article 18 of Decree 23/2025/ND-CP regulating electronic signatures and trust services, organizations are granted a public digital signature certification service business license by the competent authority when meeting the following conditions:

Subject conditions

The organization providing public digital signature certification services must be an enterprise established and operating legally on the territory of Vietnam.

Financial conditions

• Deposit at a commercial bank in Vietnam with a deposit level of 10 billion VND for every 300,000 subscribers and not lower than 10 billion VND, provided that the enterprise does not collect prepayment for more than 01 year from subscribers;
• Purchase liability insurance for damages regarding service provision activities.

Management and technical personnel conditions

Management and technical personnel of the digital signature certification service business company must include:

• Personnel for system operation: administration, operation, safety, information security, access control, monitoring and inspection, digital signature certificate lifecycle management, key lifecycle management;
• Personnel for service provision including: technical audit, security, issuance, suspension, revocation, installation, and warranty; subscriber identity verification;
• Personnel responsible for safety, information security, and confidentiality having a university degree or higher in information security and having at least 02 years of experience corresponding to the trained field;
• Personnel responsible for administration, operation, technical audit, issuance, suspension, revocation, installation and warranty, monitoring and inspection, key lifecycle management having a university degree or higher in information technology or related to information technology training and having at least 02 years of experience corresponding to the trained field.

Conditions on technical plan serving service provision activities

The technical plan serving public digital signature certification service provision activities must demonstrate the following contents:

• Comply with standards, technical regulations, technical requirements on digital signatures, digital signature certificates; trust services; network information safety; network security;
• Store fully, accurately, and update subscriber information; update the list of valid, suspended, revoked digital signature certificates; subscribers can access and use the Internet for online access 24 hours a day and 07 days a week;
• Ensure each key pair is generated randomly and exactly once; have features ensuring the private key is not discovered when there is a corresponding public key;
• Warn, prevent, and detect illegal access in the electronic environment;
• Digital signature certificate lifecycle management components designed to minimize direct contact with the electronic environment and independent of systems not serving trust services;
• The information system must ensure network information safety at least level 3 and protect personal data;
• Control entry and exit, system access rights, access rights to equipment locations;
• Backup ensuring maintenance of safe, continuous operation and troubleshooting when incidents occur, procedures for data backup, online data backup, data recovery, capable of data recovery within 08 working hours from the time the system encounters an incident; backup center at least 20 kilometers away from the main data center and ready to operate when the main system encounters an incident;
• Information system providing services located in Vietnam;
• Have certification regulations according to regulations;
• The key distribution system for subscribers must ensure the integrity and confidentiality of the key pair. In case of key distribution via computer network environment, the key distribution system must use security protocols ensuring no information leakage on the transmission line;
• Solutions to provide information by electronic means to the national electronic certification service provider, serving state management work.

Conditions for licensing public digital signature certification services

Digital signature certification service business lines

Based on Decision 36/2025/QD-TTg, from November 15, 2025, when establishing an enterprise, a digital signature certification service business company must register the following business lines:

• 6190: Other telecommunications activities (Main business line);
• 6120: Telecommunications resellers and intermediary services for telecommunications activities;
• 6219: Other computer programming;
• 6290: Other computer service and information technology activities.

Step-by-Step guide to starting a certification authority business in Vietnam

To set up a digital signature certification service business company, the following procedures need to be performed:

Procedures to a legal guide to starting a certification authority business in Vietnam

Apply for Enterprise Registration Certificate

Based on the Enterprise Law 2020 and Decree 168/2025/ND-CP, the company establishment procedure is performed as follows:

• Step 1: Prepare enterprise establishment registration dossier including:
  • Application for enterprise registration;
  • Company charter for partnerships, limited liability companies, joint stock companies;
  • List of members for partnerships, multi-member limited liability companies;
  • List of founding shareholders, list of shareholders being foreign investors of joint stock companies;
  • Copy of ID card/Citizen ID/passport of private enterprise owner, legal representative, member, owner, company shareholder, authorized representative of capital contribution (In case the above subjects declare personal identification numbers and have performed comparison with the national population database, the above papers are not attached);
  • Copy of establishment certificate of the organization for members, shareholders, owners being organizations;
  • Document appointing authorized representative of capital contribution of the organization;
  • Copy of investment registration certificate.
• Step 2: Submit dossier to the Business Registration Authority under the Department of Finance where the enterprise intends to place its headquarters online at website https://dangkyquamang.dkkd.gov.vn/;
• Step 3: The Business Registration Authority grants the Enterprise Registration Certificate within 03 working days from the date of receiving a valid dossier.

Licensing Procedure for Digital Signature Services (CA) in Vietnam

Based on Article 19, Article 20 of Decree 23/2025/ND-CP regulating electronic signatures and trust services, the procedure for applying for a digital signature certification service business license is performed as follows:

• Step 1: Prepare dossier for applying for a digital signature certification service business license including:
  • Application for digital signature certification service business license according to form;
  • Copy of enterprise registration certificate;
  • Certificate of deposit from the bank; Liability insurance for damages regarding digital signature certification service provision activities;
  • Management and technical personnel dossier including: Judicial record; Copy of university degree or higher of management and technical personnel team; Description of work and experience corresponding to management and technical personnel positions, labor contract and assignment decision;
  • Technical plan serving service provision activities;
  • Certification regulations.
• Step 2: Submit dossier to the Ministry of Science and Technology via the following forms:
  • Submit directly or send via post;
  • Submit online at the National Public Service Portal.
• Step 3: The Ministry of Science and Technology checks the validity of the dossier within 07 working days from the date of receiving the dossier. In case it is invalid: The Ministry of Science and Technology sends a notice and clearly states the reason;
• Step 4: In case the dossier is valid, continue to resolve according to the following process:
  • The Ministry of Science and Technology requests coordination to verify the dossier from the Ministry of Public Security, the Government Cipher Committee, and relevant agencies and organizations within 7 working days; agencies are responsible for replying within 20 days from the date of receiving the request;
  • The Ministry of Science and Technology grants the digital signature certification service business license to the enterprise after receiving opinions from the above agencies.
• Step 5: After being granted the license, the enterprise must implement service business conditions in practice and report the deployment of trust service provision activities;
• Step 6: Within 30 days from the date of receiving the report, the Ministry of Science and Technology grants the digital signature certificate to the enterprise.

Customers wishing for detailed advice on a legal guide to starting a certification authority business in Vietnam, please contact Viet An Law Firm for the best support!