Duties of Certifying Authorities under the IT Act

Duties under section 30 of the Information Technology Act, 2000. Every Certifying Authority shall:

1. “make use of hardware, software and procedures that are secure from intrusion and misuse” (s. 30);
2. provide a reasonable level of reliability in its services, reasonably suited to the performance of intended functions;
3. “adhere to security procedures to ensure that the secrecy and privacy of the” (s. 30) electronic signatures are assured;
4. be the repository of all electronic signature Certificates issued under the Act;
5. publish information regarding its practices, electronic signature Certificates and their current status; and
6. observe such other standards as may be specified by regulations.

Section 31. It “shall ensure that every person employed or otherwise engaged by it complies” with the Act, rules, regulations and orders made under it.

Display and surrender of licence (sections 32 and 33). It shall display its licence at a conspicuous place of its business premises, and on suspension or revocation surrender the licence to the Controller immediately.

Disclosure (section 34). It shall disclose its electronic signature Certificate, any relevant certification practice statement, notice of any revocation or suspension of its own certificate, and any fact that materially and adversely affects the reliability of a certificate it has issued or its ability to perform its services; and where an event may affect the integrity of its computer system, it shall use reasonable efforts to notify persons likely to be affected, or act in accordance with the procedure specified in its certification practice statement.

Representations on issue (section 36). While issuing a Digital Signature Certificate, it shall certify that it has complied with the Act and the rules and regulations, and that it has published the certificate or made it available to those relying on it and the subscriber has accepted it; that the subscriber holds the private key corresponding to the public key listed, a private key capable of creating a digital signature, and a public key that can verify a signature made by it; that the keys form a functioning key pair; that the information in the certificate is accurate; and that it knows of no material fact which, had it been included, would adversely affect the reliability of these representations.