The ICAO Public Key Directory: how ePassport chip signatures are checked at the border

What the PKD is

ICAO describes the PKD as a central store for exchanging the information needed to authenticate electronic machine readable travel documents. These include ePassports, electronic ID cards and visible digital seals ¹. The PKD acts as a broker. Each state uploads its own authentication information and downloads the information of other states. ICAO checks that what is exchanged meets the technical standards ¹.

More than 140 states and non-state bodies, such as the United Nations and the European Union, issue ePassports. Over 1 billion ePassports are in circulation ². The chip holds the data printed on the photo page and a country-specific digital signature ².

ICAO says a receiving state needs information from the issuing state to authenticate a foreign ePassport. It says exchanging that information state by state would be complex and error-prone, and that an ePassport gains little over a paper passport if the chip is not checked ¹.

How a chip signature is checked

Each ePassport chip carries a Document Security Object, a signed record of the data on the chip. The signature traces back through two certificates. The Document Signer Certificate (DSC) signs the chip data. The Country Signing Certification Authority (CSCA) certificate is the issuing state's national root of trust and signs the DSCs ².

At the border, the inspection system reads the Document Security Object from the chip. The passport passes if the signature checks out against the DSC and the DSC checks out against the issuing state's CSCA certificate ². The system must confirm that none of the certificates used appear on a current Certificate Revocation List (CRL) ³. ICAO's technical standard for this check is Doc 9303, Part 12 ⁴.

A clean result tells the officer two things. The document came from the proper issuing authority, and the data on the chip has not been altered ⁴. This check matters when officers or eGates rely on the facial image stored on the chip. ICAO says chip validation is needed before trusting that image, and that biometric systems can send suspected look-alike cases to a second inspection ³.

Why border agencies need the certificates

Without the issuing state's certificates, an inspection system cannot verify a chip. ICAO says ePassports that cannot be validated must be treated as non-electronic travel documents ⁴.

Through the PKD, participants get the Document Signer Certificates, CRLs and Master Lists of other states ^3,4. CSCA certificates themselves are not published for download. ICAO uses them to check DSCs, Master List signer certificates and CRLs before it publishes them ². A state deposits its CSCA certificate with ICAO in a key import ceremony, after delivering it through secure diplomatic channels ³.

ICAO assembles the ICAO Master List, which the United Nations signs and submits ². The Master List is free to download ³. Certificates are public information, and ICAO says publishing them on a state website does not breach its standards ³.

Who takes part

Any ICAO member state that issues or plans to issue electronic travel documents can join. Each state names one body to sign the memorandum of understanding with ICAO, and that can be a border control authority ³. Participants pay a registration fee and a share of operating costs, published in a fee schedule. ICAO says fees fall as participation grows ³.

The PKD started on 19 March 2007 with Australia, Canada, Japan, New Zealand, Singapore and the United Kingdom ⁵. In 2019, ICAO told its Assembly there were 66 participants ⁶. As of 19 October 2026, the ICAO participants page lists 107 entries. They include the United Nations, the European Union and the Southern African Development Community, along with Hong Kong, China, Macao, China and Bermuda ⁵. The most recent listed joiners are San Marino, Guyana, Malawi, the Dominican Republic and Brunei Darussalam, which joined on 3 September 2025 ⁵.

Joining the PKD and checking chips at the border are separate steps. ICAO has urged states to join, and says membership brings the most value when states pair it with stronger border inspections ⁶.

What happens when a chip fails

A chip can fail to read for several reasons, such as a damaged chip or antenna or a faulty reader. An ICAO working group paper from 2007 recorded broad agreement that a passport whose chip fails to read should still be treated as valid. Where there is no sign of deliberate damage, the document should be treated as valid for travel ⁸.

The same paper says a chip failure may lead to more questions and a closer look at the document. On its own, it should not lead to refusal of entry or boarding. It compares this to a machine readable zone that cannot be read, which has never been grounds for refusal by itself ⁸.

ICAO guidance leaves the detail to each state. A state decides whether to send all failed checks to a second inspection, how to handle missing certificates or revocation lists, and how to respond when a certificate is revoked ⁷. If the issuing state's certificates are not available, a system can skip the signature check, read the chip, and prompt the officer to compare the printed page, the machine readable zone and the chip data ⁷.

Why it matters to travellers

Checked chips support automated border control. ICAO says chip validation and the facial image on the chip let eGates process travellers faster ⁴. Some entry schemes depend on chipped passports. The US Visa Waiver Program, for example, requires an e-passport ⁹.

Fingerprints stored on some chips are not shared through the PKD. ICAO notes that PKD contents do not give access to fingerprint data ³. For more on what chips hold and how eGates use them, see the biometrics page.