Certifying Authorities and Electronic Signature Certificates

1. The Controller: sections 17 and 18

• Section 17: the Central Government appoints, by notification, a Controller of Certifying Authorities, and may appoint Deputy Controllers, Assistant Controllers, other officers and employees. The Controller acts under the general control and directions of the Central Government. The office has a seal.
• Section 18 lists the Controller’s functions, including:
  • supervising the activities of CAs;
  • certifying the public keys of CAs;
  • laying down standards to be maintained by CAs;
  • specifying qualifications of CA employees and the conditions of their business;
  • specifying the form and content of an Electronic Signature Certificate and the key;
  • specifying the form of accounts and the terms on which auditors are appointed;
  • resolving conflicts of interest between CAs and subscribers;
  • laying down the duties of CAs; and
  • maintaining a public database containing the disclosure record of every CA.
• The Controller, Deputy and Assistant Controllers are public servants (section 82). The Controller may make regulations after consulting the Cyber Regulations Advisory Committee and with Central Government approval (sections 88, 89).

Section 20 (Controller as repository of all certificates) was omitted in 2008. The duty to be the repository now lies on each CA (section 30(ca)).

2. Foreign Certifying Authorities: section 19

The Controller may, with the previous approval of the Central Government and by notification, recognise any foreign CA subject to conditions specified by regulations. Certificates issued by a recognised foreign CA are then valid under the Act. The Controller may revoke recognition, for reasons recorded in writing, if the conditions are breached.

3. Licensing of Certifying Authorities: sections 21 to 34

4. Issue of Electronic Signature Certificates: sections 35 and 36

• Section 35(1)–(3): any person may apply to a CA in the prescribed form, with a fee not exceeding twenty-five thousand rupees (different fees for different classes of applicants) and a certification practice statement or statement of particulars.
• Section 35(4): the CA may grant the certificate or, for reasons recorded in writing, reject the application, but only after giving the applicant a reasonable opportunity of showing cause.
• Section 36: while issuing a certificate, the CA certifies that it has complied with the Act; it has published or made the certificate available and the subscriber has accepted it; the subscriber holds the private key corresponding to the listed public key, capable of creating a digital signature; the keys form a functioning key pair; the information is accurate; and it knows of no material fact that would affect reliability.

5. Suspension and revocation: sections 37 to 39

Section 39: notice of suspension or revocation is published in the repository specified in the certificate, and in all repositories if more than one is specified. Under section 64, an unpaid penalty or compensation is recovered as arrears of land revenue and the licence or certificate stays suspended until it is paid.

6. Duties of subscribers: sections 40 to 42

• Section 40: the subscriber shall generate the key pair by applying the security procedure.
• Section 40A (2008): for an Electronic Signature Certificate, the subscriber performs such duties as are prescribed.
• Section 41: a subscriber is deemed to have accepted a certificate if he publishes or authorises its publication to one or more persons or in a repository, or otherwise shows approval. By accepting, he certifies to all who reasonably rely on it that he holds the private key and is entitled to it, that his representations to the CA are true, and that all information within his knowledge is true.
• Section 42(1): he must exercise reasonable care to retain control of the private key and take all steps to prevent its disclosure.
• Section 42(2): if the private key is compromised, he must tell the CA without delay. Explanation: the subscriber is liable until he has informed the CA.

7. Related offences and directions

• Section 68: the Controller may direct a CA or its employee to take measures or stop activities to ensure compliance. Wilful non-compliance now attracts a penalty up to twenty-five lakh rupees (Jan Vishwas Act, 2023; earlier two years or one lakh rupees).
• Section 71: misrepresentation to, or suppression of material facts from, the Controller or CA to obtain a licence or certificate: up to two years, or fine up to one lakh rupees, or both.
• Section 73: publishing a certificate knowing the CA did not issue it, the subscriber did not accept it, or it has been revoked or suspended (except to verify a signature created before): up to two years, or fine up to one lakh rupees, or both.
• Section 74: knowingly creating, publishing or making available a certificate for a fraudulent or unlawful purpose: same punishment.
• Section 66C: fraudulent use of another person’s electronic signature is identity theft (see the note on offences).

How AIBE asks this

This topic gives straight recall MCQs: who appoints the Controller (Central Government), who recognises a foreign CA (Controller, with prior Central Government approval), the maximum period of suspension of a certificate without hearing (15 days), the ten-day limit on suspending a CA licence, and that a licence is not transferable or heritable. Section 42’s rule that the subscriber stays liable until he reports a compromised key is also a common question.

Quick check

1. A foreign Certifying Authority may be recognised under section 19 by:
   (A) the Central Government alone
   (B) the Controller with the previous approval of the Central Government
   (C) the Reserve Bank of India
   (D) CERT-In
   Answer

   (B). Section 19(1), by notification in the Official Gazette.
2. An Electronic Signature Certificate cannot be suspended without hearing the subscriber for more than:
   (A) 7 days
   (B) 10 days
   (C) 15 days
   (D) 30 days
   Answer

   (C). Section 37(2). Ten days is the limit for suspending a CA’s licence under section 25(2).
3. Which is a ground for revocation under section 38(1)?
   (A) Death of the subscriber
   (B) Change of the subscriber’s address
   (C) Expiry of the CA’s audit
   (D) Non-use for one year
   Answer

   (A). Section 38(1)(b); request and dissolution or winding up are the other grounds.
4. A licence granted to a Certifying Authority under section 21 is:
   (A) transferable with the Controller’s consent
   (B) heritable but not transferable
   (C) neither transferable nor heritable
   (D) valid for life
   Answer

   (C). Section 21(3)(b).
5. Under section 42, a subscriber whose private key is compromised is liable:
   (A) for 30 days after the compromise
   (B) until he has informed the Certifying Authority
   (C) only if he was negligent
   (D) never, as liability lies on the CA
   Answer

   (B). Explanation to section 42(2).