Why Does Korean Online Identity Verification Revolve Around Certificates?

Korean banking, tax filing and government services run on a 공동인증서 (gongdong injeungseo, joint certificate): a cryptographic file you install, renew annually and present to prove who you are. Its ancestor, the 공인인증서 (gongin injeungseo, officially accredited certificate), was created in 1999 alongside Korea’s Digital Signature Act, and because the law gave one technology official legal standing, Korea’s entire online infrastructure was built around it, in Internet Explorer, through ActiveX, for 21 years. In December 2020 the law was amended. What was removed was not the certificate. It was the word ‘official’.

Year	What happened
1999	Digital Signature Act enacted; accredited certificate created
2000s to 2010s	ActiveX and Internet Explorer lock-in, annual renewal, security plug-ins
10 Dec 2020	Amended Act takes effect, removing accredited status
After 2020	Certificates continue as ‘joint certificates’, one option among many
Now	Private authentication from banks, telecoms and platforms competes

What is a Korean certificate, technically?

An older office computer on a desk in South Korea

A public key certificate. A certification authority verifies your identity once, then issues a file containing your public key signed by the authority. To authenticate or sign, your device uses the matching private key, which is itself encrypted under a password you set. The counterparty checks the signature against the authority’s chain of trust.

None of this is Korean. It is standard public key infrastructure, the same technology securing websites worldwide. What was distinctive was the legal architecture built on top of it.

Why did Korea put a certificate at the centre of everything?

Because in 1999 it needed online commerce to have legal force, and it legislated a specific answer.

The Digital Signature Act gave a particular class of certificate, issued by designated authorities, the status of 공인, officially accredited. A signature made with an accredited certificate carried presumptive legal effect equivalent to a seal or signature. That gave banks, the tax authority and government agencies something they urgently wanted: a legally defensible way to accept an instruction from a citizen over the internet.

For Korea in 1999, this was forward-looking. Other countries were still arguing about whether an electronic signature meant anything. Korea decided, legislated, and built, and the result was that Koreans were doing online banking and filing taxes electronically years before most of the world.

The problem was the shape of the decision. By granting one technology official status, the state did not merely permit it. It made everything else commercially pointless.

How did this produce the ActiveX problem?

Because the certificate had to be handled by software, the software had to run in a browser, and the browser was Internet Explorer.

To store a private key, validate it and prevent tampering, Korean institutions required client-side code with deep access to the user’s machine. Microsoft’s ActiveX provided exactly that in Internet Explorer, so Korean banking and government sites standardised on it. Then, because ActiveX controls themselves became an attack surface, institutions layered on more mandatory client software: keyboard security to defeat keyloggers, anti-virus modules, firewall components, each from a different vendor, each a separate install.

The user experience became notorious. Opening an account or filing a tax return meant a sequence of security prompts, several reboots, a browser that worked only if it was Internet Explorer on Windows, and an annual renewal because certificate validity was set to one year. Mac users were locked out. Linux users were not considered. When smartphones arrived, the whole stack had to be rebuilt as apps because it could not travel.

Korean security analysis of the period is direct about the structural cost: the environment became a standardised, unchanging government and financial internet in which the digital signature market was monopolised, blocking market entry for new authentication methods and technologies and hindering the development of authentication services. This is the part worth understanding: the certificate did not fail technically. It succeeded so completely that nothing could compete with it, and so nothing improved.

What actually changed in 2020?

The legal privilege, not the product, and the distinction matters.

The amended Digital Signature Act took effect on 10 December 2020, ending the accredited certificate system after 21 years. Korean reporting on the change was emphatic in tone, as in the government’s own “goodbye to the accredited certificate” coverage, and the detailed history of the controversy has been documented at length by Korean technology press.

But the certificate itself continued. Certificates issued after the amendment are called 공동인증서, joint certificates, and they remain in wide use for banking, tax and government services. What ended was their monopoly on legal presumption: a joint certificate is now one private authentication method among several, competing on merit rather than operating as the only option with statutory backing.

What filled the space was a market. Korean telecoms and platforms moved immediately, with reporting at the time describing a contest to capture an electronic signature market valued around 66 billion won. The practical result is the authentication menu a Korean user now sees: a joint certificate, a bank’s own certificate, the telecom-operated PASS app, platform identities from Kakao, Naver and Toss, and increasingly biometric confirmation on a phone. Related reform moved alongside it, including amendments giving electronic documents legal effect and changes via the enforcement decree.

Has it actually got easier?

Partly, and the honest answer depends on what you are doing.

Better. Everyday banking and shopping now authenticate through a phone app with a PIN or fingerprint, in seconds, with no installs. ActiveX is gone from most consumer-facing services. Mac and mobile users are no longer second-class. For routine transactions the improvement is dramatic.

Not better. The heavy cases survive. Business banking, large transfers, certain government filings, corporate tax, real estate registration and anything involving a corporate seal still frequently require a certificate file, sometimes with specified browsers and helper programs, and the annual renewal ritual persists. Anyone who has tried to complete a Korean administrative process at the business end knows the old stack is still down there.

And verification is a separate problem from authentication. Even with modern authentication methods, many Korean services require 본인인증, identity verification, which in practice means a Korean mobile phone number registered in your own name. This is the barrier that most affects foreign residents, and it is not solved by the certificate reform at all, because it is about the identity registry rather than the signature technology.

What does this mean for a foreign resident?

Expect to need a Korean phone in your own name. It is the practical key to most Korean online services, more than any certificate. A number registered to someone else, or a tourist SIM, will often fail verification.

You can obtain and use a joint certificate. It is issued through banks and certification authorities to foreign residents with a residence card, and for some services it remains the most reliable route precisely because it is the oldest and best-supported path.

Prefer app-based authentication where offered. PASS, bank apps and platform identities are faster and do not require software installs, and coverage for foreign residents has improved, though it is still uneven.

Keep a Windows machine reachable. For the remaining heavy administrative cases, having access to Windows with Internet Explorer mode or a vendor-supported browser will save a day of frustration.

Requirements change service by service and year by year, so verify with the specific institution rather than assuming a general rule.

What are the trade-offs?

What Korea got right. It decided early that digital identity needed legal force, legislated it, and built a working national system when most countries had neither. Koreans have banked, filed taxes and transacted with government online for over two decades, at a level of integration that many wealthier countries still have not reached. The certificate deserves credit for that, not ridicule.

What it cost. Granting one technology official status converted a good decision into a frozen one. For 21 years there was no commercial reason to build anything better, Korean users carried a uniquely burdensome security stack, Korean web development ossified around a single browser, and the country that was early to online government became late to the mobile internet in exactly the services that mattered most. The lock-in was not a side effect of the policy. It was the policy working.

The general lesson. This is the clearest example in Korean digital policy of a pattern worth watching elsewhere: the state can accelerate adoption enormously by designating a standard, and the same designation removes the mechanism by which standards improve. Korea spent two decades demonstrating both halves.

FAQ

Was the Korean accredited certificate abolished?

Its accredited legal status was, on 10 December 2020. The certificate itself continues as the 공동인증서, joint certificate, now one private authentication option among several.

What is the difference between gongin injeungseo and gongdong injeungseo?

공인인증서 was the officially accredited certificate with statutory legal presumption, used from 1999. 공동인증서 is the same kind of certificate issued after the 2020 amendment, without the official status.

Do I still need a certificate for Korean banking?

For everyday personal banking, usually not: app authentication with a PIN or biometrics is standard. For business banking, large transfers and some government filings, a certificate is often still required.

Why did Korean websites need ActiveX?

Because handling certificate private keys securely required client-side software with deep system access, and ActiveX in Internet Explorer provided it. Institutions then layered additional mandatory security programs on top.

Can foreigners get a Korean joint certificate?

Yes, through banks and certification authorities with a residence card. The harder barrier for foreign residents is usually identity verification requiring a Korean mobile number in your own name.

The structural answer

Korea’s certificate system is what happens when a government solves a problem completely. In 1999 nobody knew whether a click could be a signature, so Korea wrote a law saying that this particular file was, and the entire financial and administrative internet was built on top of that sentence. It worked: Koreans were banking online while other countries were still printing forms. It also meant that for 21 years no alternative could exist, which is why a country famous for fast internet spent two decades installing security plug-ins in Internet Explorer. The 2020 amendment did not throw the certificate away. It took away its legal privilege, which was the only thing preventing anything better from being built, and within a year the authentication menu had four new options on it. The file is still there. It just has to compete now.