Powers and duties of a Certifying Authority

Certifying Authority. A Certifying Authority is a person licensed under the Information Technology Act, 2000 to issue electronic signature Certificates. Its powers and duties are set out in Chapters VI and VII of the Act.

Powers:

1. To issue certificates (section 35): any person may apply to a Certifying Authority for an electronic signature Certificate, in the form the Central Government prescribes, with the prescribed fee (not exceeding twenty-five thousand rupees; different fees may be prescribed for different classes of applicants) and a certification practice statement or, where there is no such statement, the statement the regulations require.
2. To grant or reject the application (section 35(4)): after considering the statement and making such enquiries as it deems fit, it may grant the certificate or, for reasons recorded in writing, reject the application, after giving the applicant a reasonable opportunity of showing cause.
3. To suspend a certificate it has issued (section 37): on a request from the subscriber or a person authorised on his behalf, or if it is of opinion that the certificate should be suspended in public interest; not for more than fifteen days unless the subscriber has been given an opportunity of being heard, and the suspension is communicated to him.
4. To revoke a certificate it has issued (section 38): at the request of the subscriber or a person he has authorised, on his death, or on the dissolution or winding up of a subscriber that is a firm or company; and at any time if it is of opinion that a material fact in the certificate is false or concealed, that a requirement for its issue was not met, that its own private key or security system was compromised in a manner materially affecting the certificate's reliability, or that the subscriber has been declared insolvent or dead or, being a firm or a company, has been dissolved, wound up or has otherwise ceased to exist; after giving the subscriber an opportunity of being heard, and with the revocation communicated to him.

Duties:

1. Security and reliability (section 30): to use hardware, software and procedures secure from intrusion and misuse, provide a reasonable level of reliability in services reasonably suited to their intended functions, adhere to security procedures ensuring the secrecy and privacy of electronic signatures, be the repository of all electronic signature Certificates issued under the Act, publish information on its practices, on its electronic signature Certificates and on their current status, and observe the standards specified by regulations.
2. Compliance (section 31): to ensure that every person it employs or engages complies, in the course of that employment or engagement, with the Act, rules, regulations and orders.
3. Display and surrender of licence (sections 32 and 33): to display its licence conspicuously at its premises and to surrender it to the Controller immediately on suspension or revocation; failure to surrender is an offence punishable with imprisonment up to six months, a fine up to ten thousand rupees, or both (section 33(2)).
4. Disclosure (section 34): to disclose, in the manner specified by regulations, its electronic signature Certificate, its certification practice statement, notice of any revocation or suspension of its own certificate, and any other fact that materially and adversely affects the reliability of a certificate it has issued or its ability to perform its services; and, where in its opinion an event or situation may materially and adversely affect the integrity of its computer system or the conditions on which a certificate was granted, either to use reasonable efforts to notify any person likely to be affected or to act under the procedure in its certification practice statement.
5. Representations on issue (section 36): while issuing a Digital Signature Certificate, to certify that it has complied with the Act and the rules and regulations, and that it has published the certificate or made it available to those relying on it and the subscriber has accepted it; that the subscriber holds the private key corresponding to the public key listed, a private key capable of creating a digital signature, and a public key that can verify a signature made by it; that the keys form a functioning key pair; that the information in the certificate is accurate; and that it knows of no material fact whose inclusion in the certificate would have undermined the representations in clauses (a) to (d) of section 36.
6. Notice of suspension or revocation (section 39): to publish a notice of any suspension or revocation in the repository named in the certificate.

Conclusion. The Certifying Authority has the power to issue (or refuse) electronic signature Certificates, and correlative duties of security, compliance and disclosure that make those certificates reliable.