Digital Signature Certificate: grant, suspension and revocation

Application and grant (section 35). Any person may apply to a Certifying Authority for the issue of an electronic signature Certificate. The application is made in the form the Central Government prescribes, with a fee of up to ₹25,000 as prescribed (different fees may be prescribed for different classes of applicants), and is accompanied by a certification practice statement or, where there is none, a statement with the particulars specified by regulations (section 35(1)-(3)). On receipt of the application, the Certifying Authority may, after considering the certification practice statement (or the other statement the regulations require) and making such enquiries as it deems fit, grant the “certificate, or, for reasons to be recorded in writing, reject the application”; but “no application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection”. While issuing a Digital Signature Certificate, the Certifying Authority must certify (section 36) that it has complied with the Act and the rules and regulations made under it, and that it has published the certificate or made it available to persons relying on it and the subscriber has accepted it. It must also certify that the subscriber holds the private key corresponding to the public key listed in the certificate, a private key capable of creating a digital signature, and a public key that can verify a signature made by that private key; that the two keys form a functioning key pair; that the information in the certificate is accurate; and that it knows of no material fact whose inclusion in the certificate would have undermined the representations in clauses (a) to (d) of section 36.

Suspension (section 37). The issuing Certifying Authority may suspend a Digital Signature Certificate on a request from the subscriber listed in it or a person authorised to act on his behalf, or if it is of opinion that the certificate should be suspended in public interest. A certificate shall not be suspended for more than “fifteen days unless the subscriber has been given an opportunity of being heard”, and the suspension must be communicated to the subscriber.

Revocation (section 38). A Certifying Authority may revoke a certificate issued by it where the subscriber or a person authorised by him requests it, on the death of the subscriber, or on “the dissolution of the firm or winding up of the company where the subscriber is a firm or a company”. It may also revoke a certificate at any time if it is of opinion that a material fact represented in the certificate is false or has been concealed, that a requirement for its issuance was not satisfied, that the Certifying Authority's own private key or security system was compromised in a manner materially affecting the certificate's reliability, or that the subscriber has been declared insolvent or dead or, being a firm or a company, has been dissolved, wound up or has otherwise ceased to exist (section 38(2)). A certificate is not revoked unless the subscriber has been given an opportunity of being heard, and the revocation is communicated to him (section 38(3), (4)); the Certifying Authority then publishes a notice of the suspension or revocation in the repository named in the certificate (section 39).

Conclusion. Any person may apply for a certificate; the Certifying Authority grants it after due enquiry and may later suspend or revoke it on the grounds the Act lays down, after giving the subscriber an opportunity of being heard where the Act so requires.