Duties of a subscriber; suspension and revocation of the certificate

Who is a subscriber? A subscriber is a person in whose name the electronic signature Certificate is issued (section 2(1)(zg) of the Information Technology Act, 2000). Chapter VIII of the Act lays down a subscriber's duties.

Duties of a subscriber:

1. Generating the key pair (section 40): where a Digital Signature Certificate whose public key corresponds to the subscriber's private key has been accepted by him, he shall generate that key pair by applying the security procedure.
2. Prescribed duties (section 40A): in respect of an Electronic Signature Certificate, he shall perform such duties as may be prescribed.
3. Acceptance of the certificate (section 41): a subscriber is deemed to have accepted a certificate if he publishes it, or authorises its publication, to one or more persons or in a repository, or otherwise shows his approval; by accepting it he certifies to all who reasonably rely on it that he holds the private key corresponding to the public key listed in it and is entitled to hold it (s. 41(2)(a)); that all his representations to the Certifying Authority, and all material relevant to the information in the certificate, are true (s. 41(2)(b)); and that all information in the certificate within his knowledge is true (s. 41(2)(c)).
4. Control of the private key (section 42): he shall exercise reasonable care to retain control of the private key and take all steps to prevent its disclosure; if it has been compromised he shall communicate this without delay to the Certifying Authority, in the manner specified by regulations (s. 42(2)), and he remains liable until he has informed it.

The Act's sections 37 and 38 are written for the Digital Signature Certificate; what follows is what they provide for it.

Suspension (section 37). The Certifying Authority that issued the certificate may suspend it (a) on a request from the subscriber listed in it or any person duly authorised to act on his behalf, or (b) if it is of opinion that the certificate should be suspended in public interest. It shall not be suspended for more than “fifteen days unless the subscriber has been given an opportunity of being heard”, and the suspension must be communicated to him.

Revocation (section 38). The Certifying Authority may revoke the certificate (a) where the subscriber or a person authorised by him requests it, (b) upon the subscriber's death, “or (c) upon the dissolution of the firm or winding up of the company where the subscriber is a firm or a company”. It may also revoke it at any time if it is of opinion that a material fact represented in the certificate is false or has been concealed, that a requirement for its issuance was not satisfied, that the Certifying Authority's own private key or security system was compromised in a manner materially affecting the certificate's reliability, or that the subscriber has been declared insolvent or dead or, being a firm or a company, has been dissolved, wound up or has otherwise ceased to exist (section 38(2)). A certificate is not revoked unless the subscriber has been given an opportunity of being heard, and the revocation is communicated to him (section 38(3), (4)); the Certifying Authority then publishes a notice of the suspension or revocation in the repository named in the certificate, and in every one of them where more than one is named (section 39(1), (2)).