X-Road Mongolia¶

Partial · Layer 0 — Data exchange · Repo: xroad-mn · instance MN

The standardised, authenticated data-exchange layer between organisations. Built on X-Road, the technology that originated in Estonia and has since been adopted internationally; Mongolia's instance carries the identifier MN.

What it solves¶

Integration between organisations traditionally creates an N × N problem: for 20 organisations to connect to each other takes 190 pairwise integrations, each with its own authentication, its own format and its own SLA.

X-Road collapses that to N. Each organisation stands up a single security server and talks to everyone else through it. Authentication, encryption, signing, timestamping and logging are solved at the protocol level — the application does not reimplement them.

Topology¶

graph TB
    subgraph trust[Trust services]
        direction LR
        CA["eID Mongolia<br/>Root + Issuing CA<br/>OCSP / CRL"]
        TSA["timeserver.mn<br/>RFC 3161 TSA"]
    end

    subgraph control[Instance governance]
        direction LR
        CS["cs.xroad.mn<br/>Central Server (MN)<br/>signs globalconf"]
        MGMT["mgmt.xroad.mn<br/>Management SS"]
    end

    subgraph members[Member security servers]
        direction LR
        RP["rp.gerege.mn<br/>Producer SS"]
        SSG["ss.gerege.mn<br/>Consumer SS"]
        PAY["ss.paygrid.mn<br/>Member SS"]
    end

    CS -->|globalconf| RP
    CS -->|globalconf| SSG
    CS -->|globalconf| PAY
    CS -->|globalconf| MGMT
    MGMT -->|mgmt proxy| CS

    SSG -->|SS ↔ SS| RP
    PAY -->|SS ↔ SS| RP

    CA -.->|OCSP / CRL| RP
    CA -.->|OCSP / CRL| SSG
    TSA -.->|timestamp| RP
    TSA -.->|timestamp| SSG

Components¶

Server	Role
`cs.xroad.mn`	Central Server — signs and distributes the trust list (`globalconf`) for instance `MN`
`mgmt.xroad.mn`	Management security server — publishes the member-registration service
`rp.gerege.mn`	Producer security server — provides services
`ss.gerege.mn`	Consumer security server — consumes services
`ss.paygrid.mn`	A member's security server

The root of trust¶

Every X-Road message travels signed and timestamped. Who issues the certificates that make those signatures verifiable?

eID Mongolia acts as the CA for X-Road. It also serves real-time certificate validity checks over OCSP, while timeserver.mn provides RFC 3161 timestamps.

This is the one downward dependency the ecosystem permits — layer 1 supplying layer 0 with its root of trust.

Current state¶

Partial

Ready: topology planning is complete; the central server and the first security servers are up and running; the CA handover package has been prepared.

Outstanding: production rollout for broad use has not begun.

A legal precondition

The current CAs rest on a self-signed root. Under electronic-signature legislation, the root must be held by an authorised national body. This must be resolved before X-Road can be rolled out for broad use — it is a legal blocker, not a technical one.

Relationship with Gerege Verify¶

Gerege Verify is currently a lookup channel that runs alongside X-Road. Once X-Road is fully adopted, some of those lookups could move to standard X-Road services.

Full documentation¶

Membership details (member class, code, registered subsystems), server configuration and scripts live in the xroad-mn repository. It contains a directory per server, plus docs/topology.md and the handover documents.