Safe to Host Certificate
CERT-In safe-to-host certificate for websites and applications
A security audit to CERT-In guidelines, ending in a certificate tied to the exact build you will host.
- Valid for
- 1 year
- Guidelines
- CERT-In
- Verification
- QR and register
Accredited and empanelled
What is Safe-to-host certificate?
A safe-to-host certificate confirms that a web application has been audited by a CERT-In empanelled auditing organisation and that the vulnerabilities found have been closed. Government departments, NIC and state data centres commonly ask for one before a website or application goes live on their infrastructure, and the Guidelines for Indian Government Websites (GIGW) expect sites to be security audited before hosting.
The certificate records the application name, its production and test URLs, the hash value of the audited build and the path where it will be deployed. It also names the guidelines referred, the audit dates and the date on which compliance was verified. Because it is tied to a specific build, any change to the code or its hosting environment calls for a fresh audit or a re-verification.
Certificates are typically valid for one year from issue, or until the application is modified, whichever comes first. CERT-In empanelment is time-bound, and you can confirm any auditor's current status on the list published at cert-in.org.in.
Who it is for
- Government departments and ministries launching or updating websites
- Public sector undertakings and autonomous bodies
- System integrators delivering applications for government clients
- Applications to be hosted at NIC or state data centres
- Municipal bodies, universities and other publicly funded institutions
What sets audit time and cost
Most safe-to-host audits take two to four weeks from kick-off to certificate, with the length set mainly by how quickly findings are fixed and re-tested.
- Number of pages, modules and user roles in the application
- Number of URLs and environments in scope
- Dynamic features such as payments, file uploads and APIs
- Number of re-test rounds needed to close findings
- Availability of a stable test environment and test accounts
Why it matters
What Safe-to-host certificate gives you
- 01
Clearance to go live
A certificate in the form hosting teams expect, so the application can move from staging to production without a last-minute audit.
- 02
Findings you can act on
Each vulnerability comes with its severity, evidence and steps to reproduce it, so your developers fix the most serious issues first.
- 03
A traceable build
The recorded hash value lets the data centre confirm that the code it hosts is the code that was audited.
- 04
Independent assurance
The audit is carried out by an empanelled organisation that did not build the application and has no stake in how it was built.
The audit
What our auditors examine
- 01
OWASP Top 10 risks
Injection, broken access control, cryptographic failures, security misconfiguration and the other OWASP Top 10 (2021) categories, tested by hand as well as with scanners.
- 02
Authentication and sessions
Login, password reset, captcha, session timeout, cookie flags and the separation between citizen, officer and administrator accounts.
- 03
Input handling and file uploads
Server-side validation on every form and parameter, file type and size checks, and protection against path traversal in uploaded content.
- 04
Server and hosting configuration
TLS settings, HTTP security headers, directory listing, default pages, verbose errors and exposed admin interfaces on the test and production URLs.
- 05
CERT-In advisories and known CVEs
Versions of frameworks, CMS plugins and libraries checked against CERT-In vulnerability notes, the SANS CWE Top 25 and public CVE records.
- 06
Build integrity
A hash of the final audited build is computed and recorded with the deployment path, so the hosted code can be matched to the certificate.
How the audit runs
Audits follow CERT-In guidelines from scoping to the final certificate, with re-testing until findings are closed.
01
Scoping
We agree the applications, URLs, APIs, networks or assets in scope, the test environment and the rules of engagement.
02
Testing
Auditors test against CERT-In guidelines and recognised methods such as the OWASP Testing Guide, using automated tools and manual techniques.
03
Findings report
Each finding comes with its severity, evidence and the risk it poses. Your team fixes them in the audited environment.
04
Re-testing
We re-test until findings are closed or formally accepted, and record the version that was finally audited.
05
Certificate and report
The final report and certificate are issued, and the certificate is listed in the public register with a QR code for verification.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
Security audits
Web application security audit
Testing of your web application against OWASP guidance, with a certificate that names the URLs, dates and build covered.
Security audits
VAPT
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
Security audits
IT security audit
An information security audit to CERT-In guidelines covering the systems you name, closed with a dated audit certificate.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
Safe-to-host certificate questions
We audit; we do not consult.
To keep audits independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your Safe-to-host certificate audit
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.