How do I apply for a digital certificate for my company in China?

Applying for a Digital Certificate in China

Obtaining a digital certificate for your company in China is a crucial step for secure electronic transactions, compliance with local regulations, and enabling electronic signatures in business operations. This process involves selecting a certified authority, submitting documentation, and integrating the certificate into your systems. As a business observer, it's worth noting that China's digital economy emphasizes robust security and regulatory alignment, making this certificate essential for sectors like finance, e-commerce, and legal contracts. Below, we'll outline the step-by-step application process, drawing from official guidelines and practical insights.

Step-by-Step Guide to Application

1. Understand the Types of Digital Certificates: In China, digital certificates are typically issued as CA (Certification Authority) certificates compliant with national standards. For companies, the most common is the SM2-based certificate under the GB/T 38636 standard, which supports electronic signatures equivalent to handwritten ones. These are used for company seals (e-seals) or individual signer authentication. Decide if you need an organization-level certificate (for the company) or user-level (for employees).

2. Choose a Licensed Certification Authority (CA): China requires certificates from authorities accredited by the Cyberspace Administration of China (CAC) or the Ministry of Industry and Information Technology (MIIT). Popular CAs include China Financial Certification Authority (CFCA), Beijing CA, Shanghai CA, and 28Ke. For international businesses, ensure the CA supports cross-border recognition. Research via the official CA list on the CAC website (cac.gov.cn) to verify accreditation.

3. Prepare Required Documentation: Gather company details such as:

   • Business license (统一社会信用代码证书).
   • Organization code certificate.
   • Tax registration certificate.
   • Legal representative's ID (身份证).
   • Proof of authorized applicant (e.g., power of attorney).
   • Company contact information and domain verification if needed. All documents must be in Chinese or notarized translations. For foreign-invested enterprises (FIEs), include foreign enterprise registration and approval documents from the Ministry of Commerce (MOFCOM).

4. Submit the Application:

   • Visit the chosen CA's online portal (e.g., cfca.com.cn for CFCA).
   • Register an account and fill out the application form, specifying certificate type (e.g., SSL/TLS for websites or signing certificate for documents).
   • Upload scanned documents and pay fees (typically 500-2000 RMB annually, depending on validity period: 1-3 years).
   • Some CAs require an in-person verification visit to their office or a notary public for identity confirmation, especially for high-security certificates.

5. Undergo Verification and Issuance: The CA will review documents (1-5 business days) and may conduct a site audit for organization validation. Once approved, the certificate is generated as a .pfx or .p12 file, often delivered via secure email or download portal. Install it on your hardware security module (HSM) or software keystore for use in tools like e-signature platforms.

6. Integration and Renewal: Integrate the certificate with your systems, such as ERP software or e-signature vendors. Renew annually to maintain validity. Track usage to comply with audit requirements.

Challenges for businesses include bureaucratic delays (up to 2 weeks) and ensuring compatibility with international standards like eIDAS for cross-border deals. Costs can escalate with add-ons like multi-year validity or EV (Extended Validation) certificates. From a commercial perspective, this process streamlines operations but requires upfront investment in compliance expertise.

Legal Framework for Electronic Signances in China

China's electronic signature laws provide a solid foundation for digital certificates, ensuring legal enforceability. The cornerstone is the Electronic Signature Law of the People's Republic of China (2005), which recognizes reliable electronic signatures as equivalent to handwritten ones if they meet security and authentication standards. A "reliable" signature requires a digital certificate from a licensed CA, using cryptographic algorithms like SM2 (China's national standard) for integrity and non-repudiation.

Key regulations include:

• Civil Code (2020): Articles 469-490 affirm electronic contracts' validity, provided signatures use trusted certificates.
• Provisions on Electronic Authentication Services (MIIT, 2010): Mandates CA licensing and certificate management.
• Cybersecurity Law (2017): Requires data protection in electronic transactions, with penalties for non-compliance up to 1 million RMB.
• Sector-specific rules: For finance, the People's Bank of China (PBOC) enforces certificates in digital payments; for e-commerce, the State Administration for Market Regulation (SAMR) oversees platform integrations.

Unlike more flexible Western frameworks, China's laws emphasize government oversight and integration with national ID systems (e.g., real-name authentication via 实名制). This creates a high-trust environment but adds layers of scrutiny, particularly for foreign firms navigating data localization under the Data Security Law (2021). Businesses must audit certificate usage to avoid disputes in courts, where non-compliant signatures can be invalidated.

2026 update: add the CA's two licensing layers to your certificate application checklist

A company applying for a China digital certificate should look beyond the application form. It should establish which licensed legal entity receives the application, verifies the organisation, issues the certificate, and operates the cryptographic certification system.

State Cryptography Administration Order No. 6 took effect on 1 July 2026. It regulates the use of commercial cryptography by electronic certification service providers; it does not amend the Electronic Signature Law or automatically determine the validity of every contract. The separate T/CQAE 11034-2025 business-rule standard provides operational guidance and should not be described as the text of Order No. 6.

Read the 2026 China CA licence and certificate requirements for the official timeline, the distinction between the two licensing layers, and the eSign.AI/e签宝 China capability model.

What to verify

• Check the issuer's MIIT Electronic Certification Service Licence and State Cryptography Administration cryptography-use licence.
• Review the subscriber agreement, identity-review method, certificate profile, renewal and revocation process, and authorised enterprise representative.
• Ask for a sample evidence package showing the certificate chain, signing events, timestamps, and verification data.

eSign.AI's mainland China capability

eSign.AI's mainland China offering is supported by e签宝's domestic electronic-signature infrastructure. First Financial (Yicai) reported that e签宝 obtained an Electronic Certification Service Licence from MIIT in October 2024. For procurement, confirm the current licence holder, licence number, validity, covered certification system, and the evidence produced by the selected workflow.

Related: For a complete guide to electronic signatures in mainland China — including legal requirements, valid use cases, and step-by-step compliance — see our mainland China e-signature guide.