04 · Mongolia · Gerege Systems

Instance MN — Mongolia's first X-Road.

In July 2026, Gerege Systems LLC studied a greenfield X-Road rollout for Mongolia and, within a week, installed a Central Server and Security Servers and sent the first message. On July 27 all certificates moved to the national eID Mongolia organization CA, and ownership of the management server passed to the Ministry of Digital Development, Innovation and Communications.

Running X-Road 7.8.2 Production CA 2 GOV · 1 COM

Central Server

cs.xroad.mn · instance MN

Security Server

Ministry · Gerege

Member organizations

NDC · Ministry · Gerege

Management services

clientReg, ownerChange …

10+

Technical blockers solved

Root causes traced from logs

Infrastructure

What is running

All servers run X-Road 7.8.2 on Ubuntu LTS. Certificates are issued by the eID Mongolia Organization Issuing CA, valid 2026-07-27 → 2029-07-26, all REGISTERED + OCSP good.

Central Servercs.xroad.mn

Instance MN. Distributes the member registry, approved CAs and TSAs, and the signed global configuration. Member classes: GOV, COM.

instanceMN

Security Server · managementmgmt.xroad.mn

Owner: Ministry of Digital Development, Innovation and Communications. Provides the instance's 10 management services (MANAGEMENT subsystem). NDC is an additional member.

instMN

classGOV

code6806252

servermgmt

Security Server · Geregess.gerege.mn

Owner: Gerege Systems LLC. Subsystems: EIDMONGOLIA (e-ID Mongolia services), GEREGE-WALLET-BFF (Gerege Wallet app backend).

instMN

classCOM

code6235972

serverGEREGE-SS-1

Members

Registered organizations

Identifier	Organization	Role	Status
MN/GOV/6806252	Ministry of Digital Development, Innovation and Communications	Owner of the mgmt server, provider of management services	REGISTERED
MN/GOV/5323304	National Data Center (NDC)	Additional member. Owned mgmt until 2026-07-27	REGISTERED
MN/COM/6235972	Gerege Systems LLC	Owner of the GEREGE-SS-1 server; EIDMONGOLIA, GEREGE-WALLET-BFF	REGISTERED

Trust services

Built on the national PKI

The slowest part of X-Road to prepare is not the servers but the CA. In three of the five countries studied (Colombia, Brazil, El Salvador), PKI compatibility was the biggest blocker. Gerege set up an organization CA, OCSP and TSA for X-Road, separate from citizen eID.

eID Mongolia Organization Issuing CA

The only CA approved in the instance (valid until 2046). Has AIA/CDP. Issues organization SIGN and server AUTH certificates. Separate from the citizen eID CA.

OCSP · RFC 6960

rp-api.eidmongolia.mn/ocsp

OCSP signer issued by the organization CA and rotated every 90 days. It is not pinned, so X-Road recognizes the new one automatically.

TSA · RFC 3161

tsa.timeserver.mn

Timestamps for the message log. On a separate domain from the CA, which helps with the legal "independent TSA" requirement.

Timeline

Two months, three servers

2026-04

First trial

A test instance on Gerege's earlier monorepo, trialing the GEREGE-ID service.

2026-07-21

Research

Five reports drawing on 20+ countries: strategy, X-Road vs UXP, costs and benchmarks, CA plan, architecture.

2026-07-22

Instance MN is born

Installed Central Server 7.8.2 and initialized the MN instance via the REST API. A Security Server joined, Gerege's CA bundle was registered, and the first end-to-end message went through.

2026-07-27

Production CA · new owner

All certificates were reissued by the eID Mongolia Organization Issuing CA and the test CA was removed for good. mgmt owner: NDC → Ministry. GEREGE-SS-1 was built on the production CA from scratch.

2026-08-08

mgmt server restored

Restored the signer from backup on a new VM, keeping the registration valid without touching the CA at all.

2026-08-15

ss.gerege.mn migration

Moved from behind NAT to a new host with a public IP via backup/restore. X-Road ID, keys, certificates and registration all kept.

2026-08-25

Ministry SIGN certificate

The ministry's (6806252) signing certificate was issued and management services came fully online. Code moved to GitLab.

Lessons

Root causes found in logs

A few of the 10+ real blockers we documented:

If OCSP gets stuck on unknown, restarting the signer is not enough; the OCSP cache must be cleared too.
Just getting a certificate signed is not enough: if it is not in the CA's database, OCSP returns unknown.
There were two CAs whose names differed by one word. Always check the SHA-256 against the global configuration before signing.
Don't replace the Central Server admin UI certificate: internal management services trust its self-signed certificate. We solved it with a proxy in front.
A Security Server can host only one additional member besides its owner.
An extra A record in the TSA's DNS made ~50% of timestamp requests fail.
If the Central Server rotates its internal signing key, all previous anchors become invalid.

Next steps

Road to production

Register producers

The instance has no service providers yet. Publish the EIDMONGOLIA OpenAPI description and start real exchange between organizations.

Root chain

Chain the organization CA under the NDC national root (Law on Digital Signatures, 2021).

TSA independence

A legal opinion on whether the CA itself may run the TSA.

MN certificate profile

Currently the country-neutral Basic profile. Upstream a Mongolian profile to NIIS.

Hardening and hosting

Close admin ports, host production in a data center in Mongolia, 99.9%+ SLA and multiple responders for OCSP.