Digital Signature Certificate: purpose and content

Purpose of a digital signature certificate. A Digital Signature Certificate is issued by a Certifying Authority under section 35 of the Information Technology Act, 2000. Its purpose is to bind the subscriber to his public key, so that anyone relying on a digitally signed record can verify the signature with the public key the certificate lists and trust that it belongs to the subscriber.

Content. In issuing the certificate the Certifying Authority certifies (section 36) that “the subscriber holds the private key corresponding to the public key listed in the” certificate, that the private key can create a digital signature which the listed public key can verify, that the subscriber's public and private keys constitute a functioning key pair, that the information in the certificate is accurate, and that it knows of no material fact which, if included, would adversely affect the reliability of the representations in clauses (a) to (d) of section 36. The Act itself does not list every field of the certificate; its provisions show that the certificate lists the subscriber (section 37 speaks of "the subscriber listed in the Digital Signature Certificate") and the public key that corresponds to his private key (section 36(c)), and that the Certifying Authority vouches for the accuracy of the information it contains. The fields themselves are prescribed by rule 7 of the Information Technology (Certifying Authorities) Rules, 2000: every certificate a Certifying Authority issues must follow the ITU X.509 version 3 standard and must contain, among other data,

1. a serial number that the Certifying Authority assigns to tell it apart from other certificates; (b) the signature algorithm identifier, naming the algorithm the Certifying Authority used to sign it; (c) the issuer name, that is, the Certifying Authority that issued it; (d) its validity period; (e) the name of the subscriber whose public key it identifies; and (f) the subscriber's public key information.