Telco systems usually run large-scale, centralized key management systems. However, centralized approaches based on conventional public key encryption like RSA raise problems such as key escrow, secure channel to delivery key, and third-party query as well as single point of failure. To address these problems, we propose both certificate-based encryption (CBE) and hierarchical certificate-based encryption (HCBE) schemes proved secure in the standard model. Compared with other schemes, our schemes are proved IND-CCA2 (Indistinguishability under Adaptive Chosen Ciphertext Attack) secure in full model, where the number of group elements is independent of the value of security parameter. As far as we know, the proposed HCBE is the first fully IND-CCA2 secure scheme with ciphetexts of constant size.