ICP-Brasil: how the Brazilian Public Key Infrastructure works

A ICP-Brazil It is the hierarchical chain of trust that underpins the issuance of certificates and digital signatures in the Brazilian standard. Established in 2001, it connects the Management Committee, the National Institute of Information Technology (ITI), Certification Authorities, Registration Authorities and other participants responsible for identity, certification and trust services.

This infrastructure is present in tax, legal, business, and other processes. accounting managementHowever, it should not be confused with a single body, platform, or free service. The model functions as a chain of trust with a single root, in which ITI acts as the Root Certification Authority.

Furthermore, ICP-Brasil is currently undergoing an important transition: new types of certificates have already begun to be issued and, starting in March 2029, some older categories will no longer be used. In this article, we explain the current structure and what companies and users need to be aware of.

Summary

• ICP-Brasil is a hierarchical chain of trust, not an isolated public body.
• ITI acts as the Root Certification Authority and supervises the participants in the infrastructure.
• Certification Authorities issue and administer certificates; Registration Authorities identify and register applicants.
• Digital certificates link an identity to a pair of cryptographic keys.
• The structure is migrating to A3/A4 certificates for individuals, Electronic Seals for legal entities, and Special Application certificates.
• Issuance may involve in-person validation or validation via video conference, according to the rules of the Certification Authority.

Quick facts

• Chain of trust: o ITI defines ICP-Brasil as a hierarchical chain of trust with a single-root certification model.
• Institutional affiliation: o ITI Internal Regulations of 2026 It informs that the agency is linked to the Ministry of Management and Innovation in Public Services and acts as a Root AC (Agency for the Development of the State).
• ZapSign in the ICP-Brasil system: o official repository of ITI ZAPSIGN is registered as valid since March 2026 for issuing A3, SE-S, and SE-H forms in the v12 chain.

What is ICP-Brasil?

ICP-Brasil, acronym for Brazilian Public Key Infrastructure, was established by Provisional Measure No. 2.200-2, from 2001. Its function is to organize a chain of trust for the issuance, management, and verification of digital certificates and other services related to electronic identification.

Therefore, it is more accurate to describe it as a national digital certification infrastructure rather than as a public body or service provided directly to the citizen.

The certificates issued in this chain can be used for authentication, qualified signature, and other compatible processes, including in digital contracts.

The existence of an official chain does not mean, however, that every Brazilian electronic document must necessarily use an ICP-Brasil certificate. Provisional Measure No. 2.200-2 itself allows for other means of proving authorship and integrity when accepted by the parties or the recipient, according to the conditions stipulated in the regulation.

How does ICP-Brasil work?

ICP-Brasil operates through a hierarchy. Each participant has its own responsibilities within the process of issuing, validating, monitoring, and using certificates.

ICP-Brazil Hierarchy

Among the main components of the structure are:

• ICP-Brasil Management Committee;
• Root Certification Authority (AC-Raiz);
• Certification Authorities of subsequent levels;
• Registration Authorities (ARs);
• Time Stamp Authorities (TSAs) and other accredited providers;
• Certificate holders and users.

Participant	main function	Example of responsibility
Management Committee	Defines the policies, criteria, and standards of ICP-Brasil.	To approve technical rules and guidelines for the infrastructure.
ITI / AC-Root	Executes policies and oversees the supply chain.	To accredit, monitor, and audit participants.
Certificate Authority	Issues and manages certificates.	Issue, renew, and revoke certificates in accordance with your policy.
Registration Authority	Identifies and registers the applicant.	Validate identity and forward requests to AC.
Time Stamp Authority	Emits timestamps	Associating reliable date and time with electronic events.

Root Certification Authority

The National Institute of Information Technology is a federal agency currently linked to the Ministry of Management and Innovation in Public Services. Within the ICP-Brasil (Brazilian Public Key Infrastructure), it plays the role of... Root Certification Authority.

Among its functions are executing the policies approved by the Management Committee, managing certificates of the immediately subordinate Certification Authorities, carrying out accreditation and de-accreditation, and supervising and auditing. processes of the members of the chain.

Certification Authorities (CA)

Certification Authorities can be public or private entities accredited to issue, distribute, renew, revoke, and manage digital certificates within authorized policies.

It is important to correct a common misconception: the holder does not receive a “public certificate” and a “private certificate.” What exists is a… cryptographic key pairThe private key must remain under the control of the holder, while the public key is embedded in the certificate and can be used for verification.

Registration Authority (AR)

A Registration Authority It functions as an operational link between the user and a specific Certification Authority. The RA is responsible for identifying and registering applicants, verifying information, and forwarding requests for issuance or revocation.

Timestamps, on the other hand, are issued by accredited Time Stamp Authorities. Therefore, RAs and TSAs have different roles within the infrastructure.

What exactly is a digital certificate?

Um digital certificate It is an electronic document issued and signed by a Certification Authority that links a person or entity to a pair of cryptographic keys after verifying their identity.

In digital signatures, the private key is used to generate the signature, while the corresponding public key allows verification of the relationship between the signer, the certificate, and the signed content.

This technology contributes primarily to authenticity and integrityThis does not mean that every signed document is automatically encrypted or hidden from third parties. Confidentiality depends on specific encryption, storage, and access control mechanisms.

Similarly, no certificate should be described as capable of "stopping hackers" or making an operation absolutely inviolable. Security also depends on protecting the private key, the device, the credentials, and the infrastructure used.

A document digitally signed A document issued under the ICP-Brasil certificate produces a qualified electronic signature, which has the legal treatment stipulated by law. This should be distinguished from saying that any document automatically has the same signature. legal validity In any situation, as certain actions may require specific formalities.

What are the types of digital certificates in ICP-Brasil?

The Brazilian system is in a transition period. Until March 2, 2029, certificates from the previous model, such as A1, A2, A3, A4 and S categories, can continue to be used under the current conditions. In parallel, the v12 chain already allows the issuance of the new types.

It is also important not to confuse digital signature with a digitized signature. The second is basically an image or reproduction of a handwritten signature; the first uses cryptographic mechanisms.

When performed with an ICP-Brasil certificate, the signature with digital certificate It qualifies as a qualified electronic signature.

A1

The A1 form is stored in software and is valid for one year. Currently, it can still be issued and used, but Resolution No. 211/2024 established its discontinuation in the new structure starting in March 2029.

A3

The A3 certificate can be stored on a card, cryptographic token, or in cloud infrastructure. In the structure still in place during the transition, its validity can vary from one to five years, depending on the certificate issued.

A4

The A4 remains within the certificate framework and is also part of the new model for signature certificates intended for individuals. Instead of simply classifying it as "the most secure," it is more appropriate to consider the policy, cryptographic environment, and technical requirements applicable to the specific certificate.

Electronic Seal

O Electronic Seal (SE) This is one of the main new features of the model. It will be used by legal entities to link the origin and integrity of documents and automated processes.

The seal does not represent a personal expression of will. ITI itself compares its role to an institutional stamp: it identifies the organization as the origin of or responsible for the document.

Special Applications

The new structure also provides for certificates of Special Applications (SA), intended for specific use cases defined by the technical regulations of ICP-Brasil.

⚠️ Also check out these related articles 👇

➡️ Learn how to sign with a digital certificate
➡️ Understand what a digital signature verifier is for
➡️ What is a digital contract and how to adopt one for your company

What changes will occur in ICP-Brasil by March 2029?

Resolution CG ICP-Brasil No. 211/2024 initiated a significant modernization of available certificates. During the transition period, the old and new infrastructure coexist.

• to March 2th, 2029The current certificates, including A1, A2, A3, A4, S1, S2, S3 and S4, can continue to be used;
• from March 3th, 2029Categories A1, A2, and S1 through S4 are no longer used;
• The new model signature certificates are aimed at individuals, primarily in the A3 and A4 categories;
• Legal entities will now use Electronic Seals to identify the origin of documents and automated processes;
• Business systems that rely on certifications need to be adapted before the end of the transition.

For businesses, the change deserves attention, especially regarding integrations with ERPs, tax systems, robots, APIs, and automations that currently rely on corporate tax certificates stored in software.

When we founded ZapSign, we had two very clear principles: legal validity and simplicity. As the market matured, we understood that it was also possible to advance in the trust infrastructure itself. That's why we decided to seek accreditation as a Certification Authority without turning it into a layer of complexity for those who just want to sign a document.

In 2022, we began this process. It took years of technical steps and audits until ZapSign was accredited as a Certification Authority in 2026. For me, this move reinforces the idea that legal security needs to evolve without abandoning the simple experience that has guided the product from the beginning.

💡 Tip! Need a free digital signature? Click here and create yours now!

How do I obtain my digital certificate through ICP-Brasil?

The process varies depending on the Certification Authority and the type of certificate, but it can be summarized in the steps below.

1. Choose a Certification Authority

Start by choosing one of the Certification Authorities accredited by ICP-Brasil. ITI maintains the official list. using this link.

2. Request issuance

Access website From the chosen Certification Authority, select the product that best suits your needs and check costs, required documents, and storage methods.

3. Verify identity.

Validation can take place in person at a Registration Authority or, when the procedure allows, via videoconference.

In the in-person validation process, the applicant presents the required documentation and goes through the identification and registration procedures established by the Registration Authority (RA). In the remote modality, documents are sent in advance and identity is confirmed during a video conference with the responsible agent.

4. Receive and protect the certificate.

After approval, the certificate is made available according to its type. The A1 certificate can be downloaded to a compatible device; the A3 certificate can be delivered on a card or token or made available in the cloud.

After issuance, take extra care to protect the private key and authentication factors. Sharing files, passwords, tokens, or access credentials can compromise the certificate's reliability.

It is also necessary to monitor the validity and renew it according to the procedures of the Certification Authority. Relevant registration changes may require updating or a new issuance, as the case may be.

Now that you understand what ICP-Brasil is, its hierarchy, and the changes planned for the coming years, it's easier to assess when a digital certificate makes sense for your operation. ZapSign is also now part of this chain as a Certification Authority; to learn more about the platform, just click here.

Frequently asked questions about ICP-Brasil