What is MobileCERT?
MobileCERT is India's hardware-anchored mobile PKI solution, jointly developed by the Controller of Certifying Authorities (CCA), MeitY and C-DAC Bengaluru. It transforms your eligible smartphone into a certified digital identity device.
Secure Key Storage
Cryptographic keys are generated and kept permanently inside your phone's dedicated hardware security chip — they never leave the device.
Legal PDF Signing
Sign PDF documents that are legally recognised under Indian law, with signatures fully compliant with the IT Act and CCA guidelines.
High Assurance
Works exclusively on devices equipped with FIPS 140-2 / 140-3 certified hardware security modules — military-grade protection.
Digital Identity Credential
Operates as a trusted mobile identity, enabling seamless and paperless identity verification for government and enterprise services.
Banking-Grade Authorization
Integrate Digital Signature-based transaction authorization as a superior, non-repudiable alternative to OTP-based methods.
Zero Trust Model
Every session undergoes mandatory 6-point device security validation before any cryptographic operation is permitted.
The Digital Opportunity in India
India's smartphone ecosystem is massive — and the prime opportunity lies with users who already have the hardware ready.
The "Sleeping Giants"
55-60 million Indians already carry devices with FIPS-class hardware security modules in their pockets. MobileCERT can instantly deploy high-assurance DSCs to this premium segment — dramatically accelerating market penetration without any hardware investment by end-users.
The Digital Vault: StrongBox & SEP
Mobile PKI doesn't rely on ordinary storage — it uses a dedicated, isolated security chip built into the device hardware specifically for cryptographic operations.
The Security Chip
A dedicated, isolated chip inside your phone — separate from the main processor — designed exclusively for encryption and key management. It ensures keys can never be extracted by any software on the device.
StrongBox (Android)
A "Keymaster" implementation within a dedicated Secure Element. Available on Pixel 3+ (Titan M/M2 chip) and high-end Samsung Galaxy devices with Knox hardware vaults. Requires Android 9 or higher.
Secure Enclave (iOS)
Apple's dedicated Secure Enclave Processor (SEP) keeps biometric and cryptographic data entirely isolated from the application processor, available on iPhone 5s (A7 chip) and all later models.
Creating Your Digital Lock & Key
Asymmetric cryptography forms the foundation. During registration your phone's secure chip generates two mathematically linked keys.
Asymmetric Cryptography
When you register, the secure chip generates a key pair that works like a personalised lock and key. This pair is unique to your device and identity — mathematically impossible to forge.
Signing is performed entirely inside the hardware vault, so your private key is never exposed to app memory, the operating system, or any external party.
Private Key
Stays permanently locked inside the hardware vault. It never leaves your phone and cannot be accessed by any application, including MobileCERT itself.
Public Key
Shared with the Certifying Authority (CA) for DSC issuance. The CA associates your public key with your verified identity and issues the signed certificate.
Journey to Your Digital Certificate
Four streamlined steps from registration to a fully issued Digital Signature Certificate stored securely on your device.
Register
Receive official credentials (User ID & Challenge Code) via email from the Certifying Authority.
Generate
The secure hardware chip generates your unique cryptographic key pair — private key stays inside the vault.
Request
The app creates a Certificate Signing Request (CSR) and transmits it to the CA API Server over SSL.
Receive
The CA validates and issues your DSC. It is downloaded and stored securely in the app's local database.
Signing Documents with a Tap
The PDF signing module delivers legally binding digital signatures in seconds, with the private key never exposed outside the hardware vault.
- Open any PDF from local storage within the app.
- Draw a signature box at the desired position on the page.
- The app computes a cryptographic "Digital Fingerprint" (message digest) of the PDF.
- The digest is sent to the StrongBox / SEP — the hardware vault signs it using your Private Key.
- Re-enter credentials for final authentication confirmation.
- The signed PDF is renamed and saved to your local storage — legally binding and tamper-evident.
Transaction Authorization Flow
The 6-Point Safety Guard
MobileCERT uses a "Zero Trust" model. Every session, before any signing operation, the app runs six mandatory hardware and software health checks. If any critical check fails, access is denied.
Root Check
Verifies the device is not rooted or jailbroken, ensuring the OS has not been compromised and the secure hardware boundary is intact.
StrongBox / SEP Support
Confirms the device possesses the required FIPS-certified hardware security module (StrongBox on Android, Secure Enclave on iOS).
Google CA Present
Validates that the device's certificate trust store contains valid Certificate Authorities, ensuring authenticity of CA communications.
Remote Access App
Scans for installed screen-mirroring or remote-control applications that could allow malicious actors to observe or intercept signing actions.
Developer Mode
Detects if Android Developer Options are active. If enabled, the app displays a risk warning before proceeding, as developer mode can expose vulnerabilities.
USB Debugging
Detects if USB debugging is enabled — a known attack vector for external device access. A critical warning is shown and users are advised to disable it.
Is Your Device Supported?
MobileCERT requires FIPS-certified hardware security. FIPS 140-2/3 certification means your device's security hardware is tamper-resistant and independently validated by a globally recognised testing authority.
Google Pixel
FIPS 140-3 Level 3 (Pixel 8+)
Samsung Galaxy
Z Fold3/Flip3 and newer
FIPS 140-3 (S24, S25, Fold/Flip 5-6)
Apple iPhone
FIPS 140-3 Level 3 (iPhone 11+)
Other Flagships
SPU must be enabled by OEM
Full Compatibility Matrix
| Platform | Eligible Models | FIPS Compliance | Security Requirement |
|---|---|---|---|
| Google Pixel | Pixel 3 - Pixel 7 | FIPS 140-2 Level 2 | Titan M or M2 Security Chip |
| Pixel 8 and newer | FIPS 140-3 Level 3 | Titan M2 Security Chip | |
| Samsung Galaxy | S21, S22, S23, Z Fold/Flip 3 & 4 | FIPS 140-2 | Knox with Hardware Vault |
| S24, S25, Z Fold/Flip 5 & 6 | FIPS 140-3 | Knox with Hardware Vault | |
| Apple iPhone | iPhone 5s - iPhone X | FIPS 140-2 Level 2 | Secure Enclave Processor (SEP) |
| iPhone 11 and newer | FIPS 140-3 Level 3 | Secure Enclave Processor (SEP) | |
| Other Flagships | Snapdragon 855 chips or newer | FIPS 140-2 Level 2 | Enabled SPU (Secure Processing Unit) |
FIPS (Federal Information Processing Standard) is a globally recognised security benchmark. FIPS 140-2/3 certified hardware is independently audited and validated as tamper-resistant.
Technical Architecture
Built on a layered, separation-of-concerns architecture ensuring each component has a defined, auditable security boundary.
Technology Stack & Key Libraries
KeyPairGenerator for asymmetric keys; X509Certificate for DSC parsing.
StrongBox integration — private keys generated and isolated inside the hardware security module.
X509TrustManager & SSL/TLS for secure, encrypted channel with CA API Server.
Background threads for API calls and file operations — no UI blocking during signing or download.
Current Development Status
MobileCERT is actively in development with the Android platform ready for release.
Android Platform
Full development complete. All three core modules (Download Certificate, View Certificates, Sign PDF) are functional and tested across multiple device models.
iOS Platform
All core features operational. Document Signing module implementation is the final pending item. Uses Swift & SwiftUI with Apple Secure Enclave Processor integration.
App store links will be updated upon official release. Currently available via direct distribution for authorised evaluators. Device must pass all 6 security checks to use the application.
Hardware Security Compliant
Under the Office of CCA, MeitY
Government of India