The Trauma of Securing a Code Signing Certificate – The Government of India needs to Intervene against hegemony of MNCs

A boutique Indian cyber security firm (a proprietorship) just went through a nightmarish experience with an MNC when it sought to secure a Code Signing Certificate (CSC). The MNC simply refused to recognise several valid documents issued by the Government of India.

The Indian firm has a GST registration, a MSME registration and has over the last few years continuously offered protection against cyber security threats to over a dozen blue chip firms in the Banking & Financial Services Sector. Most of the firm’s business is repeat business on an annual subscription model.

The firm wrote a small executable which can dig into viruses on hard disks and wanted a secure a code signing certificate in this connection.

The first code signing vendor said that they can only issue a certificate to a company incorporated with the Ministry of Company Affairs and thus rejected the application. Fortunately, no application fee has been paid and the matter ended there.

A second vendor was approached, an application was filed on a website and a fee of approximately US $ 200 paid. Then the nightmare started. The firm received a verification email seeking to know if it were a private limited company. It said that it was a proprietorship, with a GST and MSME registration, and even offered to show the Purchase Orders (POs) from clients in order to prove its legitimacy. However, the vendor was firm and said that it could only issue a certificate to a Private Limited firm. When a refund was sought, there was no reply.

The vendor then said that GST and MSME registrations were not acceptable and sought alternative verification. This involved securing a landline, a certification from the firm’s CA about its existence as a registered and genuine entity, CA’s certification of physical location at the same place as the landline, Aadhar card photocopy (front and back), and also a selfie with the front and back display of the Aadhar card. Further, the firm’s representative was required to be at the landline location to receive a call which proved to be a complication because of the lockdown. Finally, the CA himself had to go through a verification process.

This whole experience highlights the importance of a intervention by the Government of India in the area of code signing certification and a localisation of the same. Otherwise MNCs will end up controlling the process, with the power to even disregard official registrations issued by the Government of India.