Certifying Authority: definition and duties

Definition. Under section 2(1)(g) of the Information Technology Act, 2000, a "Certifying Authority" is a person licensed under section 24 to issue electronic signature Certificates. A certification practice statement is the statement in which a Certifying Authority sets out the practices it follows in issuing those certificates.

Duties of a Certifying Authority (sections 30 to 34). Every Certifying Authority must:

1. Secure systems (s. 30): use hardware, software and procedures protected against intrusion and misuse, and give a reasonable level of reliability in its services, suited to what they are meant to do;
2. Secrecy (s. 30): follow security procedures that keep electronic signatures secret and private;
3. Records and publication (s. 30): be the repository of all electronic signature Certificates issued under the Act, and publish its practices, its certificates and their current status;
4. Standards (s. 30): observe any further standards laid down by regulations;
5. Its staff (s. 31): see that everyone it employs or engages complies with the Act, the rules, the regulations and the orders made under it in the course of that work;
6. Display of licence (s. 32): display its licence prominently at the premises where it carries on business;
7. Surrender of licence (s. 33): surrender its licence to the Controller as soon as it is suspended or revoked; failure is an offence punishable with up to six months' imprisonment, a fine of up to ten thousand rupees, or both;
8. Disclosure (s. 34): disclose, as regulations specify, its own electronic signature Certificate, any relevant certification practice statement, any suspension or revocation of its certificate, and any fact that materially and adversely affects the reliability of the certificates it has issued or its ability to perform; and, where an event may compromise its computer system or the conditions of a certificate, make reasonable efforts to notify those likely to be affected, or follow the procedure in its certification practice statement.
9. Representations on issue (s. 36): while issuing a Digital Signature Certificate, certify that it has complied with the Act and the rules and regulations, and that it has published the certificate or made it available to those relying on it and the subscriber has accepted it; that the subscriber holds the private key corresponding to the public key listed, a private key capable of creating a digital signature, and a public key that can verify a signature made by it; that the keys form a functioning key pair; that the information in the certificate is accurate; and that it knows of no material fact which, had it been included, would adversely affect the reliability of these representations.

Conclusion. A Certifying Authority is the licensed issuer of electronic signature Certificates; the Act holds it to standards of security, reliability, secrecy, record-keeping and disclosure so that the certificates it issues can be trusted.