Electronic Signature Certificates and Subscribers

In one line

A person applies to a Certifying Authority for a certificate, the Authority certifies eight things when it issues one, it may suspend for fifteen days or revoke after a hearing, and the subscriber who accepts a certificate warrants its contents to everyone who relies on it and stays liable until he reports a compromise.

In the wording a student can write in an exam: by the Explanation to section 42 of the Information Technology Act, 2000 it is declared for the removal of doubts that the subscriber shall be liable till he has informed the Certifying Authority that the private key has been compromised.

Why the certificate is the centre of the scheme

The certificate is what makes a signature mean anything. It is a statement by a licensed body that a named subscriber holds the private key corresponding to a listed public key. Everything in Chapter II rests on that statement being true.

So the Act regulates three moments. Issue, when the Authority makes its representations; suspension and revocation, when the statement stops being reliable; and acceptance, when the subscriber adopts it and becomes answerable for it.

Issue

Section 35(1) and (2). Any person may apply to a Certifying Authority in the prescribed form, with a fee not exceeding twenty five thousand rupees payable to the Authority. The proviso allows different fees for different classes of applicants.

Section 35(3). The application must be accompanied by a certification practice statement or, where there is none, a statement containing such particulars as regulations specify.

Section 35(4). The Authority may, after considering that statement and making such enquiries as it thinks fit, grant the certificate or reject the application for reasons recorded in writing. The proviso: no rejection unless the applicant has been given a reasonable opportunity of showing cause.

A drafting point the footnotes reveal. Section 35(4) once had two provisos; the first was omitted by Act 10 of 2009 and "Provided further" became "Provided", both with effect from 27 October 2009.

What the Authority certifies, section 36

On issuing a certificate the Certifying Authority certifies that:

(a) it has complied with the Act, rules and regulations;

(b) it has published the certificate or made it available to persons relying on it, and the subscriber has accepted it;

(c) the subscriber holds the private key corresponding to the public key listed;

(ca) the subscriber holds a private key capable of creating a digital signature;

(cb) the public key listed can be used to verify a signature affixed by that private key;

(d) the subscriber's public and private keys constitute a functioning key pair;

(e) the information in the certificate is accurate; and