.Public Key Infrastructure helps create a safer and more trusted environment for accessing and using digital services. Through digital certificates and electronic signatures, users can have greater confidence in the identity of the parties they interact with online and the authenticity and integrity of electronically signed information.
What is PKI?
PKI stands for Public Key Infrastructure, and is a system of technologies, policies and procedures used to manage digital certificates and encryption keys, helping to secure digital communications and electronic transactions.
What is an electronic signature?
An electronic signature provides a way to sign information or documents electronically. Recognised electronic signatures can help verify who signed a document and determine whether the information was changed after it was signed.
What is a digital certificate?
A digital certificate is an electronic credential used within the PKI ecosystem to help verify the identity of a person, organisation, system or digital service.
What is CRAN's role?
CRAN serves as Namibia’s Root Certification Authority and oversees the national PKI trust framework. CRAN is also responsible for accrediting Certification Service Providers and monitoring their compliance with applicable requirements.
Why is PKI important?
PKI provides the trust infrastructure needed to support secure digital identity, electronic signatures, e-Government, e-Commerce and other digital services. It contributes to cybersecurity and helps build confidence in Namibia’s growing digital economy.
When will CRAN publish its CPS on the web site?
CRAN will publish the list of approved CSPs on the DigiNam website at
https://rootca.cran.na/ as and when they are approved.
Why is the signing ceremony with CSPs conducted manually?
The ceremony is conducted manually for security reasons and in line with international best practice.
When will CRAN launch, and when will the Ministry of Home Affairs, Immigration, Safety and Security launch the national eID?
CRAN will launch on 31 August whilst the Ministry will launch thereafter.
Has CRAN set up all the systems required to carry out its regulatory mandate?
CRAN has implemented the required systems and has separated the relevant duties internally.
If an SOE wants to use e-signatures, where should it apply?
At any CSP of your choice.
When will CSPs be operational?
CRAN has only received one (1) application to date from the Ministry of Home Affairs, Immigration, Safety and Security.
Does CRAN foresee issuing public keys in future?
No. This is the responsibility of the CSP.
Will card readers be provided by the Ministry of Home Affairs, Immigration, Safety and Security?
There are multiple vendors providing card readers.
Can long-term verification be provided?
Yes.
What types of certificates will be issued?
Authentication and digital-signature certificates will be issued.
Is Veridos the provider for the Ministry of Home Affairs, Immigration, Safety and Security and CRAN?
Yes. CSPs are required to select their own vendors for their respective enterprises.
What will a member of the public need to apply for a new company online?
Applicants will need to complete the required forms and sign them using the national eID. BIPA will act as a relying party, while the Ministry of Home Affairs, Immigration, Safety and Security will advise on the verification process.
Is the eID traceable to the unique citizen number?
A unique hash is created for security reasons.
Will the Root CA reside with the CSP?
Root CAs will be published by CRAN, where they can be verified by relying parties
How will the witnessing of signed documents be handled?
Witnesses may also sign digitally.
What fees will apply?
Fees are available in Government Gazette No. 8808, dated 17 December
2025.
Why should a foreign CSP have local presence?
A local presence helps protect local customers. A local agent provides this assurance and fulfils the role of the Registration Authority.
Comments:
- Banks should liaise with the Ministry of Home Affairs, Immigration, Safety and Security on the modalities of the KYC process, for example, the opening of accounts.
- A bank may apply to be accredited as a CSP, should it wish to do so, or it may rely on another CSP. This remains a business decision.