Domain map

Every domain in the ecosystem points at exactly one platform. The domain name itself tells you which layer and which line the thing belongs to:

• *.gerege.mn → the private-sector line,
• *.dgov.mn → the government line,
• eidmongolia.mn, xroad.mn, timeserver.mn → infrastructure that sits above both lines and serves them equally.

Private-sector line — *.gerege.mn

Domain	Platform	Layer	Status
gerege.mn	Gerege Platform	3	Production
sso.gerege.mn	Gerege SSO — OIDC provider	2	Production
dan.gerege.mn	DAN Gateway	2	Production
gsign.gerege.mn	G-Sign — signing gateway	2	Production
xyp.gerege.mn	Gerege Verify — legal-entity lookups	0/2	Production
nexus.gerege.mn	Gerege Nexus — upstream deployment	3	Production
open.gerege.mn	Gerege Template Platform	3	Needs checking
developer.gerege.mn	Developer Portal	4	Production
wallet.gerege.mn	Gerege Wallet	4	Partial
docs.gerege.mn	This documentation site	—	Production

Government line — *.dgov.mn

Domain	Platform	Layer	Status
sso.dgov.mn	Government SSO (DAN-Government)	2	Production
template.dgov.mn	Government Template Platform V3.0	3	Production
developer.dgov.mn	DGOV Developer Portal	4	Production
ring.dgov.mn	Ring System — process re-engineering	4	Production
hurdan.dgov.mn	The "Khurdan" platform	4	Production

See Government line (dgov.mn) for the detail.

open.gerege.mn — checked on 2026-08-07

open.gerege.mn still resolves to 38.180.145.75, but that host now serves only the nexus.gerege.mn certificate, so an HTTPS request fails with a name mismatch. In other words, the Template Platform's public deployment has been replaced by Gerege Nexus. Whether the domain will be restored is unclear, so check any documentation or RP configuration that points at it.

Independent brand domains

Some products of the ecosystem belong to a separate legal entity, so they do not live under *.gerege.mn but carry a root domain of their own:

Domain	Platform	Layer	Status
geregekiosk.mn	Gerege Kiosk — self-service terminal. As of 2026-08-07 it serves a Gerege Nexus deployment.	4	Production
eduge.mn	Eduge.mn — the education-sector fork of Gerege Nexus	3	Production

A separate domain does not exempt anything from the layer rule: Kiosk is a layer-4 app, so it never reaches eID directly but goes through Gerege SSO.

Shared infrastructure

Domain	Role	Layer
eidmongolia.mn	eID Mongolia — identity/PKI core	1
ocsp.eidmongolia.mn	OCSP responder — certificate validity	1
timeserver.mn · tsa.timeserver.mn	RFC 3161 timestamping (TSA)	1
cs.xroad.mn	X-Road central server (instance MN)	0
mgmt.xroad.mn	X-Road management security server	0
rp.gerege.mn	X-Road producer security server	0
ss.gerege.mn	X-Road consumer security server	0

The *.gerege.mn domains on X-Road

By their names, rp.gerege.mn and ss.gerege.mn look like they belong to the private-sector line, but by their function they are layer 0 X-Road security servers. The domain name tells you the owner; the function tells you the layer.

Mirrored pairs

The direct correspondence between the two lines:

Role	Government	Private sector
SSO	sso.dgov.mn	sso.gerege.mn
Template	template.dgov.mn	open.gerege.mn
Developer portal	developer.dgov.mn	developer.gerege.mn
Identity	eidmongolia.mn (shared)	eidmongolia.mn (shared)

Domain naming convention

1. The function is the subdomain — sso., template., developer., docs., wallet. and so on. Name the function, not the brand.
2. The line is the base domain — either gerege.mn or dgov.mn.
3. Infrastructure gets its own domain — eidmongolia.mn, xroad.mn, timeserver.mn. These belong to neither line, so they were not placed under either one.

Rebrands leave residue in configuration

Domains and brands have changed several times over the years (for example dan.dgov.mn → sso.dgov.mn). At every such change three things must be updated together — redirect URIs, certificate SANs and RP configuration — and forgetting one makes login fail silently. When changing a domain, use the checklist on the Authentication & authorization page.