Grant and revocation of a Digital Signature Certificate

Grant (section 35 of the Information Technology Act, 2000). Any person may apply to a Certifying Authority for an electronic signature Certificate. The application is made in the form the Central Government prescribes, with a fee of up to ₹25,000 as prescribed (different fees may be prescribed for different classes of applicants), and is accompanied by a certification practice statement or, where there is none, a statement with the particulars specified by regulations (section 35(1)-(3)). On receipt of the application, the Certifying Authority may, after considering the certification practice statement (or the statement the regulations require) and making such enquiries as it deems fit, grant the certificate or, for reasons recorded in writing, reject the application; no application is rejected unless the applicant has had a reasonable opportunity of showing cause against the proposed rejection. On issuing a Digital Signature Certificate, the Certifying Authority certifies that it has complied with the Act and its rules and regulations, and that it has published the certificate or made it available to persons relying on it and the subscriber has accepted it (section 36). It must also certify that the subscriber holds the private key corresponding to the public key listed in the certificate, a private key capable of creating a digital signature, and a public key that can verify a signature made by that private key; that the two keys form a functioning key pair; that the information in the certificate is accurate; and that it knows of no material fact which, had it been included, would adversely affect the reliability of these representations.

Revocation (section 38). “A Certifying Authority may revoke a Digital Signature Certificate issued by it”:

1. where the subscriber, or any other person authorised by him, requests it;
2. upon the death of the subscriber;
3. “upon the dissolution of the firm or winding up of the company, where the subscriber is a firm or a company” (s. 38); and
4. at any time, if it is of opinion that a material fact represented in the certificate is false or has been concealed, that a requirement for its issuance was not satisfied, that the Certifying Authority's own private key or security system was compromised in a manner materially affecting the certificate's reliability, or that the subscriber has been declared insolvent or dead or, being a firm or a company, has been dissolved, wound up or has otherwise ceased to exist (section 38(2)). A certificate is not revoked unless the subscriber has been given an opportunity of being heard, and the revocation is communicated to him (section 38(3), (4)); the Certifying Authority then publishes a notice of the suspension or revocation in the repository named in the certificate (section 39).

Conclusion. The certificate is granted on application after the Certifying Authority's enquiry, and may be revoked on the subscriber's request, his death or dissolution, or where its basis proves false or deficient.